Edit tour

Windows Analysis Report
valyzt.msi

Overview

General Information

Sample name:	valyzt.msi
Analysis ID:	1582346
MD5:	53614b87538306b4f7437db8be2a0e47
SHA1:	a6a777b24bb64067738386caa66787b8ed225726
SHA256:	e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8
Tags:	knkbkk212msiuser-JAMESWT_MHT
Infos:

Detection

XRed

Score:	100
Range:	0 - 100
Whitelisted:	false
Confidence:	100%

Signatures

Antivirus detection for URL or domain

Antivirus detection for dropped file

Found malware configuration

Multi AV Scanner detection for dropped file

Multi AV Scanner detection for submitted file

Suricata IDS alerts for network traffic

Yara detected XRed

AI detected suspicious sample

C2 URLs / IPs found in malware configuration

Document contains an embedded VBA macro with suspicious strings

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Document contains an embedded VBA with functions possibly related to HTTP operations

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Drops PE files to the document folder of the user

Drops executables to the windows directory (C:\Windows) and starts them

Machine Learning detection for dropped file

Uses dynamic DNS services

AV process strings found (often used to terminate AV products)

Checks for available system drives (often done to infect USB drives)

Creates a process in suspended mode (likely to inject code)

Creates files inside the system directory

Deletes files inside the Windows folder

Document contains an embedded VBA macro which executes code when the document is opened / closed

Dropped file seen in connection with other malware

Drops PE files

Drops PE files to the application program directory (C:\ProgramData)

Drops PE files to the windows directory (C:\Windows)

Drops files with a non-matching file extension (content does not match file extension)

Found dropped PE file which has not been started or loaded

IP address seen in connection with other malware

JA3 SSL client fingerprint seen in connection with other malware

May infect USB drives

May sleep (evasive loops) to hinder dynamic analysis

Monitors certain registry keys / values for changes (often done to protect autostart functionality)

One or more processes crash

PE file contains executable resources (Code or Archives)

Queries the volume information (name, serial number etc) of a device

Sample file is different than original file name gathered from version info

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Classification

Process Tree

System is w10x64

msiexec.exe (PID: 7128 cmdline: "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\valyzt.msi" MD5: E5DA170027542E25EDE42FC54C929077)

msiexec.exe (PID: 1408 cmdline: C:\Windows\system32\msiexec.exe /V MD5: E5DA170027542E25EDE42FC54C929077)

MSI4755.tmp (PID: 1124 cmdline: "C:\Windows\Installer\MSI4755.tmp" MD5: 71386F37F17778126296CA734975DB6D)

Synaptics.exe (PID: 6520 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate MD5: ACA4D70521DE30563F4F2501D4D686A5)

WerFault.exe (PID: 8156 cmdline: C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 3156 MD5: C31336C1EFC2CCB44B4326EA793040F2)

EXCEL.EXE (PID: 3060 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding MD5: 4A871771235598812032C822E6F68F19)

Synaptics.exe (PID: 7260 cmdline: "C:\ProgramData\Synaptics\Synaptics.exe" MD5: ACA4D70521DE30563F4F2501D4D686A5)

cleanup

Malware Configuration

Threatname: XRed

{"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Yara Signatures

Initial Sample

Source	Rule	Description	Author	Strings
valyzt.msi	JoeSecurity_XRed	Yara detected XRed	Joe Security
valyzt.msi	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Dropped Files

Source	Rule	Description	Author
C:\Users\user\Documents\EEGWXUHVUG\~$cache1	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Users\user\Documents\EEGWXUHVUG\~$cache1	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\RCX49C5.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\RCX49C5.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Windows\Installer\MSI4699.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Windows\Installer\MSI4699.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Windows\Installer\674551.msi	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Windows\Installer\674551.msi	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\Windows\Installer\MSI4755.tmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\Windows\Installer\MSI4755.tmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_XRed	Yara detected XRed	Joe Security
C:\ProgramData\Synaptics\Synaptics.exe	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Click to see the 7 entries

Memory Dumps

Source	Rule	Description	Author
00000004.00000003.2105707960.0000000000773000.00000004.00000020.00020000.00000000.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_XRed	Yara detected XRed	Joe Security
00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security
Process Memory Space: MSI4755.tmp PID: 1124	JoeSecurity_XRed	Yara detected XRed	Joe Security
Process Memory Space: Synaptics.exe PID: 6520	JoeSecurity_XRed	Yara detected XRed	Joe Security

Unpacked PEs

Source	Rule	Description	Author	Strings
3.0.MSI4755.tmp.400000.0.unpack	JoeSecurity_XRed	Yara detected XRed	Joe Security
3.0.MSI4755.tmp.400000.0.unpack	JoeSecurity_DelphiSystemParamCount	Detected Delphi use of System.ParamCount()	Joe Security

Sigma Signatures

System Summary

Sigma detected: Wow6432Node CurrentVersion Autorun Keys Modification

Source: Registry Key set

Author: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: C:\ProgramData\Synaptics\Synaptics.exe, EventID: 13, EventType: SetValue, Image: C:\Windows\Installer\MSI4755.tmp, ProcessId: 1124, TargetObject: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Synaptics Pointing Device Driver

Sigma detected: Office Macro File Creation

Source: File created

Author: Nasreddine Bencherchali (Nextron Systems): Data: EventID: 11, Image: C:\ProgramData\Synaptics\Synaptics.exe, ProcessId: 6520, TargetFilename: C:\Users\user\AppData\Local\Temp\EbdP5pVY.xlsm

Suricata Signatures

ET MALWARE Snake Keylogger Payload Request (GET)

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:46:22.147888+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49709	142.250.186.174	443	TCP
2024-12-30T11:46:22.170043+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49710	142.250.186.174	443	TCP
2024-12-30T11:46:23.123167+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49714	142.250.186.174	443	TCP
2024-12-30T11:46:23.152498+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49716	142.250.186.174	443	TCP
2024-12-30T11:46:24.118313+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49719	142.250.186.174	443	TCP
2024-12-30T11:46:24.141235+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49720	142.250.186.174	443	TCP
2024-12-30T11:46:25.100339+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49723	142.250.186.174	443	TCP
2024-12-30T11:46:25.110473+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49724	142.250.186.174	443	TCP
2024-12-30T11:46:25.870288+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49730	142.250.186.174	443	TCP
2024-12-30T11:46:25.870327+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49731	142.250.186.174	443	TCP
2024-12-30T11:46:26.923984+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49737	142.250.186.174	443	TCP
2024-12-30T11:46:26.964376+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49738	142.250.186.174	443	TCP
2024-12-30T11:46:27.933383+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49744	142.250.186.174	443	TCP
2024-12-30T11:46:27.957017+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49746	142.250.186.174	443	TCP
2024-12-30T11:46:28.912183+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49748	142.250.186.174	443	TCP
2024-12-30T11:46:28.940968+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49750	142.250.186.174	443	TCP
2024-12-30T11:46:29.885211+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49754	142.250.186.174	443	TCP
2024-12-30T11:46:29.916391+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49755	142.250.186.174	443	TCP
2024-12-30T11:46:30.927049+0100	2044887	1	A Network Trojan was detected	192.168.2.5	49764	142.250.186.174	443	TCP

ETPRO MALWARE W32.Bloat-A Checkin

Timestamp	SID	Severity	Classtype	Source IP	Source Port	Destination IP	Destination Port	Protocol
2024-12-30T11:46:22.654552+0100	2832617	1	Malware Command and Control Activity Detected	192.168.2.5	49713	69.42.215.252	80	TCP

Joe Sandbox Signatures

Click to jump to signature section

Show All Signature Results

AV Detection

Antivirus detection for URL or domain

Source: http://xred.site50.net/syn/Synaptics.rarh	Avira URL Cloud: Label: malware
Source: http://xred.site50.net/syn/SSLLibrary.dlD	Avira URL Cloud: Label: malware

Antivirus detection for dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\Synaptics.exe	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Users\user\Documents\EEGWXUHVUG\~$cache1	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Users\user\Documents\EEGWXUHVUG\~$cache1	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\Windows\Installer\MSI4755.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\Windows\Installer\MSI4755.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006
Source: C:\ProgramData\Synaptics\RCX49C5.tmp	Avira: detection malicious, Label: TR/Dldr.Agent.SH
Source: C:\ProgramData\Synaptics\RCX49C5.tmp	Avira: detection malicious, Label: W2000M/Dldr.Agent.17651006

Found malware configuration

Source: valyzt.msi

Malware Configuration Extractor: XRed {"C2 url": "xred.mooo.com", "Email": "xredline1@gmail.com", "Payload urls": ["http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download", "https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1", "http://xred.site50.net/syn/SUpdate.ini", "https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download", "https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1", "http://xred.site50.net/syn/Synaptics.rar", "https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download", "https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1", "http://xred.site50.net/syn/SSLLibrary.dll"]}

Multi AV Scanner detection for dropped file

Source: C:\ProgramData\Synaptics\RCX49C5.tmp	ReversingLabs: Detection: 91%
Source: C:\ProgramData\Synaptics\Synaptics.exe	ReversingLabs: Detection: 92%
Source: C:\Users\user\Documents\EEGWXUHVUG\~$cache1	ReversingLabs: Detection: 91%
Source: C:\Windows\Installer\MSI4755.tmp	ReversingLabs: Detection: 92%
Source: C:\Windows\SysWOW64\._cache_MSI4755.tmp	ReversingLabs: Detection: 55%

Multi AV Scanner detection for submitted file

Source: valyzt.msi	Virustotal: Detection: 70%			Perma Link
Source: valyzt.msi	ReversingLabs: Detection: 65%

AI detected suspicious sample

Source: Submited Sample

Integrated Neural Analysis Model: Matched 91.7% probability

Machine Learning detection for dropped file

Source: C:\Windows\SysWOW64\._cache_MSI4755.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\Synaptics.exe	Joe Sandbox ML: detected
Source: C:\Users\user\Documents\EEGWXUHVUG\~$cache1	Joe Sandbox ML: detected
Source: C:\Windows\Installer\MSI4755.tmp	Joe Sandbox ML: detected
Source: C:\ProgramData\Synaptics\RCX49C5.tmp	Joe Sandbox ML: detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49885 version: TLS 1.2

Source: C:\Windows\System32\msiexec.exe	File opened: z:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: x:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: v:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: t:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: r:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: p:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: n:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: l:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: j:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: h:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: f:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: b:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: y:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: w:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: u:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: s:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: q:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: o:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: m:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: k:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: i:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: g:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: e:	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	File opened: c:	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File opened: a:	Jump to behavior

Source: MSI4755.tmp, 00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: MSI4755.tmp, 00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: [autorun]
Source: MSI4755.tmp, 00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp	Binary or memory string: autorun.inf
Source: Synaptics.exe, 00000004.00000003.2105707960.0000000000773000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2105707960.0000000000773000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: [autorun]
Source: Synaptics.exe, 00000004.00000003.2105707960.0000000000773000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: autorun.inf
Source: valyzt.msi	Binary or memory string: [autorun]
Source: valyzt.msi	Binary or memory string: [autorun]
Source: valyzt.msi	Binary or memory string: autorun.inf
Source: Synaptics.exe.3.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.3.dr	Binary or memory string: [autorun]
Source: Synaptics.exe.3.dr	Binary or memory string: autorun.inf
Source: MSI4699.tmp.1.dr	Binary or memory string: [autorun]
Source: MSI4699.tmp.1.dr	Binary or memory string: [autorun]
Source: MSI4699.tmp.1.dr	Binary or memory string: autorun.inf
Source: ~$cache1.4.dr	Binary or memory string: [autorun]
Source: ~$cache1.4.dr	Binary or memory string: [autorun]
Source: ~$cache1.4.dr	Binary or memory string: autorun.inf
Source: MSI4755.tmp.1.dr	Binary or memory string: [autorun]
Source: MSI4755.tmp.1.dr	Binary or memory string: [autorun]
Source: MSI4755.tmp.1.dr	Binary or memory string: autorun.inf
Source: RCX49C5.tmp.3.dr	Binary or memory string: [autorun]
Source: RCX49C5.tmp.3.dr	Binary or memory string: [autorun]
Source: RCX49C5.tmp.3.dr	Binary or memory string: autorun.inf
Source: 674551.msi.1.dr	Binary or memory string: [autorun]
Source: 674551.msi.1.dr	Binary or memory string: [autorun]
Source: 674551.msi.1.dr	Binary or memory string: autorun.inf

Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: excel.exe

Memory has grown: Private usage: 2MB later: 69MB

Networking

Suricata IDS alerts for network traffic

Source: Network traffic	Suricata IDS: 2832617 - Severity 1 - ETPRO MALWARE W32.Bloat-A Checkin : 192.168.2.5:49713 -> 69.42.215.252:80
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49710 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49714 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49716 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49709 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49720 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49723 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49730 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49731 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49738 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49746 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49748 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49750 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49724 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49737 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49754 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49719 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49755 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49764 -> 142.250.186.174:443
Source: Network traffic	Suricata IDS: 2044887 - Severity 1 - ET MALWARE Snake Keylogger Payload Request (GET) : 192.168.2.5:49744 -> 142.250.186.174:443

C2 URLs / IPs found in malware configuration

Source: Malware configuration extractor

URLs: xred.mooo.com

Uses dynamic DNS services

Source: unknown

DNS query: name: freedns.afraid.org

Source: Joe Sandbox View

IP Address: 69.42.215.252 69.42.215.252

Source: Joe Sandbox View

JA3 fingerprint: 37f463bf4616ecd445d4a1937da06e19

Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1
Source: unknown	UDP traffic detected without corresponding DNS query: 1.1.1.1

Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-Alive
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cache
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=BBE26vPeC2hszqsXJ1ynrQW_9kLsZpsHYQPDP6eN2y2zdlFo-23O9GeRsAmPENzIlI7naznndqiKAzIJmuZItjQAXwfSAfPPnvZybJ9AaZfi_PUMO8gtrIeAc_xFc3PJOBW4tiY_9Etp3P_tRX_kZ_fi85pZ8xHBt0DyAqqJlwGZY_uPHd-1V5ba
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=BBE26vPeC2hszqsXJ1ynrQW_9kLsZpsHYQPDP6eN2y2zdlFo-23O9GeRsAmPENzIlI7naznndqiKAzIJmuZItjQAXwfSAfPPnvZybJ9AaZfi_PUMO8gtrIeAc_xFc3PJOBW4tiY_9Etp3P_tRX_kZ_fi85pZ8xHBt0DyAqqJlwGZY_uPHd-1V5ba
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeHost: docs.google.comCache-Control: no-cacheCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1User-Agent: Synaptics.exeCache-Control: no-cacheHost: drive.usercontent.google.comConnection: Keep-AliveCookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
Source: global traffic	HTTP traffic detected: GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1User-Agent: MyAppHost: freedns.afraid.orgCache-Control: no-cache

Source: global traffic	DNS traffic detected: DNS query: docs.google.com
Source: global traffic	DNS traffic detected: DNS query: xred.mooo.com
Source: global traffic	DNS traffic detected: DNS query: freedns.afraid.org
Source: global traffic	DNS traffic detected: DNS query: drive.usercontent.google.com
Source: global traffic	DNS traffic detected: DNS query: 18.31.95.13.in-addr.arpa

Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5jEhBcWx3sRRM4WZuFl_r-sXa1SCE-JtoxSHHzZ_dDCkofAOrf1X5kSKU5lp7ru2-r5OIj91wContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:23 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-BfyCk6bHpOewH1saaVnLVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerSet-Cookie: NID=520=BBE26vPeC2hszqsXJ1ynrQW_9kLsZpsHYQPDP6eN2y2zdlFo-23O9GeRsAmPENzIlI7naznndqiKAzIJmuZItjQAXwfSAfPPnvZybJ9AaZfi_PUMO8gtrIeAc_xFc3PJOBW4tiY_9Etp3P_tRX_kZ_fi85pZ8xHBt0DyAqqJlwGZY_uPHd-1V5ba; expires=Tue, 01-Jul-2025 10:46:23 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5PqNcK1rReNjhVhnt2YfE2vXAFa4Su6ooWKO68EeyIYFcOUzZ96bepjVF7_Pgfpyvw8fBohTUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:23 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-y1gv4eopPdMqwlpUe6prDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs; expires=Tue, 01-Jul-2025 10:46:23 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7KL3WGOmHGwIlJfUTtBVGOya9N_kCo6q9qyMXNpWiNXcfDUh72JcWtvOAuSnICovmZContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:24 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-QHIHeyzzJ3QW49Q7PNz5ew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ; expires=Tue, 01-Jul-2025 10:46:24 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7Gn29z9D7JZU6RY8EDTBJ9ct_1-Ddi2pR44YfZC2hYrMVLuB34PLL_5mjRm-YdbBGQzCt50gsContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:24 GMTP3P: CP="This is not a P3P policy! See g.co/p3phelp for more info."Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: script-src 'report-sample' 'nonce-WztmJEkd3N1en903BUi2SQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerSet-Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg; expires=Tue, 01-Jul-2025 10:46:24 GMT; path=/; domain=.google.com; HttpOnlyAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC65GHuUhtBjlaYCUURTznVflu6pJrqucO2NsOGhBhXV859lP0SoGFuXjy-J7cIPVhcA9NyjIjQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:25 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-bh9ThQyCviSXW9TAZPP2pw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7iLvb8YJnSAOAxRgJu6jit2o2nXZp4Xyq2neJoC-26-ZfsN19OKmABu3ti7riL9runContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:25 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-52CMQh1NzCaUhZ7y8Uhr2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6BihuvC21EXEIS39FTaH0fJlyF9JdWf_xS_PbyTTwFwj8NALRBrdgRphFz-hZAKJkIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:27 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-XKEdl4sY34ADx8AOdZvzfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4lRxXvKqntFmAv49Kt_DmVIJBv-cyzvu61-qlSY2NoyyDWxGmrAl7dD6TqXaJJF4jAq4R8KE8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:27 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-5Tf15NjmFzJ_KpNbum2L9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4V4EcuqXGEyBy--vxWpRD16bls4hrnar4F-wnXNfyOl-LglW7VWHeyq1uTZibe7pqeNLajpWUContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:28 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-thT4M306q7AMBhXZYfMdpw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4pHj7yTg57lqWyJoWRdz0WXUcltGR-Kn-KyNJuyDZlG8Us2omXWAnt7DPTftgRPnDjContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:28 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-QNLp2Me4-0lJgGtoff4mhw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7psqz03pYJdyF-3-vzKK6TQNaVxe4RVeja77z5QcFNFOgZn9R60PB0PEIwrXjakT9yContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:30 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-k5Qi4i2LOPmJ6iX7UQ9XCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5rZFDVBRDrnDzLfjzUqEGWebBGL4LCaCnJId78kvhzF8qbVVQZHNVMrkNIVHiIcR50MkxczG4Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:30 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-Qewve3RB0NYr2ccV7nWqxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4qyV9TWFqT9NnLWWOjZYA8acCeA_ddnAk_YucCUym_fP0EL2rTwoZRQTtnSJ8ZBicZContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:31 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-peMrP7kaTL3aP7sXMcNaZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5lsNClKSn5db9bU27Uyje9Z6XOKQrrvv7dyL4mfiJPEOW039smoGvvtaR_2xamTH1XContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:32 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-R7Q5-sFlFXCUwa2vSh0KVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4BlNKBlY0iR8c48VlhhnGUzOzC4Qy9QSB-P5O2y7NZ2lfT2tsOcH_dgd5NGiMyatLlq0ng5vYContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:32 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-hpP6T0Ritup_f1cssajd4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6dMrQDPsApcCtUzrwevCuvLGZGLQ7h8yXvstPvAW_x9-BovWjD8dnLWro_idiIVX0Zg-g-a68Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:33 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-tumOFnVyVHgbKwJ9zWSZFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7INzbUNYBFIBWutVzZk2kxWKrVWj0m8vfLwFTpU9lhY6UIkWgLH9_jP_5jCTI2yAkJhiFAS7EContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:34 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-O_5y2BxyfTnfbedJ6JuFhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7_LzXVOPHk1zy02ujums4x9ocqNfziH5KRqyHhfc-E82tlFT6RoJQ6MthNPi-X19VVContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:35 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-33GJqMlK8Jsh_0Pp8Arv6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5sGdVSkZMHNf8RKW2yNZtrtIcJCFmJ6NJZBpy6HPbStB5eXRKI0AthS24HA6soaUv_Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:36 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-zoIHPCHMHKSeV-G3pnaCvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4SRYTN8JCguFe6pxvW1q4j_sxTbwuWY-PyogfFpjcEVAbfpPY12e1do2gxs8IGDcs39KevjykContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:36 GMTCross-Origin-Opener-Policy: same-originAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-LZr15ntIk5bahUJ8WV0OpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4Ue6LrGCymefIM-wbLv0yeXqHbDzzCCABWpzeN9oUSFgVTpklSoq1MqVzdWTl3MRxfGEoHal8Content-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:37 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Security-Policy: script-src 'report-sample' 'nonce-BTlHEkSFFbaUvAwNzkrKwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC4xjACCzHWQkpTnzF4IdBeJWsbwQ8Wt4lz6MUoOTPLpvjzfwRJ9EWn_41ql3JpGIsvDEYJk17AContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:38 GMTContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-E2vbfZLdLrHL0K0ASADqig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5MBK4o0TL8mdsA9J_jz_jBMxJf5q5LcYOKlflX-LyYD2qvXCQEKPOnO5abtACBsHcDContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:38 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-MW0amh_X7GCwXdQ2VnB8uQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC6gV8BCzfGuYQhN2yQ05qyRfLlKtyL6XvkoLqYy93hb7MqCKY0TvNVdZgM37-M3sCTFContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:39 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-hIn7nv2L5sbpFkff6ZyNjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC58Y-WbYDfyGcg6wNq57iZrlxztHUeya1O6ZVbIzyhqI7l-uSMtHQVLwmgRjhfZ8QPdB0YN0GEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:40 GMTContent-Security-Policy: script-src 'report-sample' 'nonce-BgGfeNyE0wB1fa_h8G_ofw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Cross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC59nJl1KRdaMi3b3O_E3ZsO6sRFUeM3hddZ0F46xi9LxbMV5wgJknNsLObLVMk51xAQContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:40 GMTAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-Yq12V9ypN3Q7d5XeW16JRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7H5jGutOktHQL-51asoFmk3Dwzs3TkdD0XYZuaA9Wm-FHmjpRaRWMym0CUKHi8Gd4RContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:41 GMTPermissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Content-Security-Policy: script-src 'report-sample' 'nonce-zpFUKac8DfKWTZbNXvnsAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportAccept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionCross-Origin-Opener-Policy: same-originContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC7eZY5umXs1nM3GPXuVab-m0HSMYihxJVcFXhlRcztjSRDK6xK6i60iBio9CoXvly7fz8dlIHEContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:49 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-e50PC8pBzN40j-9n-PgyCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close
Source: global traffic	HTTP traffic detected: HTTP/1.1 404 Not FoundX-GUploader-UploadID: AFiumC5HZPBfwWfJ54z6GnsFPZ38A-gGc6uoj3I-wV904YsrG3nJmCeWdLBgUoL6DQ6t5vlGf17lcMIContent-Type: text/html; charset=utf-8Cache-Control: no-cache, no-store, max-age=0, must-revalidatePragma: no-cacheExpires: Mon, 01 Jan 1990 00:00:00 GMTDate: Mon, 30 Dec 2024 10:46:50 GMTCross-Origin-Opener-Policy: same-originContent-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreportContent-Security-Policy: script-src 'report-sample' 'nonce-v_G_P6LB-MOKZBKjJ2BQ3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self'Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=*Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-VersionContent-Length: 1652Server: UploadServerAlt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000Content-Security-Policy: sandbox allow-scriptsConnection: close

Source: 674551.msi.1.dr	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
Source: Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978h
Source: MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978x
Source: Amcache.hve.12.dr	String found in binary or memory: http://upx.sf.net
Source: MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dlD
Source: 674551.msi.1.dr	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll
Source: Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SSLLibrary.dll6
Source: 674551.msi.1.dr	String found in binary or memory: http://xred.site50.net/syn/SUpdate.ini
Source: Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/SUpdate.iniZ
Source: 674551.msi.1.dr	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rar
Source: Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarZ
Source: MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: http://xred.site50.net/syn/Synaptics.rarh
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2408827318.000000000EF1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/.googl.
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/.youtubeeducatiZ
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/M
Source: Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/Microsoft
Source: Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/R
Source: Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/apps.cn
Source: Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/bleclick.cn
Source: Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/e?M
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/imiz
Source: Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/project.org.cn
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EF1E000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/r
Source: Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/syndication-cn.com
Source: Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/ube.com
Source: Synaptics.exe, 00000004.00000002.2412059221.0000000012C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2409682805.00000000100EE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0;
Source: MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downlo
Source: 674551.msi.1.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=download
Source: Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSTmlVYkxhSDg5TzQ&export=downloadN
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEV
Source: Synaptics.exe, 00000004.00000002.2403570018.000000000AA5E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&
Source: MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downlo
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2406176432.000000000D61E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2401978923.000000000889E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396245918.000000000486E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2404618386.000000000BE5E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2402460770.000000000929E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2398733458.000000000701E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2402568669.000000000951E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2410054312.000000001086E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2397903311.0000000005D8E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2404000242.000000000B1DE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2406803814.000000000E16E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2398633419.0000000006D9E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2406666698.000000000E01E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2398845599.000000000729E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2409450576.000000000FBEE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2412366894.000000001327E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2398682291.0000000006EDE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2409998792.000000001072E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396316708.00000000049AE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2410669204.0000000010EAE000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#a
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download#c
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$BC
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$_L
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$a
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$aU
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download$u
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%c
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download%e
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&-
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&b
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download&x
Source: Synaptics.exe, 00000004.00000003.2154935594.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(G
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(b
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(d
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(r
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download(z
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download)A
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-b
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-c
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download-x
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.a
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.c
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.u
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download.uv/
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download/M
Source: Synaptics.exe, 00000004.00000003.2154935594.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download08b
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0c
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0cY
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download0p
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1B
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download1H
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2I
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download2Z
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download3
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5C
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5a
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download5c
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download6
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7G
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download7zi
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8_X
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8a
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8b
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download8u
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download9I
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:-
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:F
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download:M
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;DY
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download;r
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=A
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download=u
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download?c
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadA
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAA
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAb
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadAx?
Source: Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadB
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBa
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadBc
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadC
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadCM
Source: Synaptics.exe, 00000004.00000003.2154935594.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadD;
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDc
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadDs)
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadE
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadEH8
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadF
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadFI=
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadG
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGB
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadGa
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadH8:
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHcq
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadHp
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadI
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIB
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIa
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadIc
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadJ
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154935594.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadK
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKG
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKJ
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKb
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadKz5
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadL
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLb
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadLx2
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadM
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMC
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadMI
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2408827318.000000000EF0C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadN
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNF
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadNM
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadOC(
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP
Source: Synaptics.exe, 00000004.00000002.2396381633.0000000004AEE000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2401493555.0000000007D5E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPL2
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadP_p
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPay
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadPu
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadQ
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR-
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadR2s
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadRa
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154935594.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadS
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSM
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSN
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSc
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSe
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadSec-C
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadT
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTa
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTc
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadTr
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadU
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUA
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUF
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadUM
Source: Synaptics.exe, 00000004.00000003.2154935594.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadV
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVJ
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadVd
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadW
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadX;J
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXI
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXbA
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadXs
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadY
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadYB
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_150xe
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2411893896.000000001287E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloada
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadaBY
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadate
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadb)
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbFQ
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadbM
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadc
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcati
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadceD
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadcisco
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadd
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddH
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddate7
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaddel=
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloade
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadeCU
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadec
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfB
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfa
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadfe-in
Source: Synaptics.exe, 00000004.00000003.2154935594.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadgc
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadge
Source: Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadh_
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadha
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhc
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadhu5
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadi
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiF$
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiM
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadicX
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadig
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadim
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadiop
Source: Synaptics.exe, 00000004.00000003.2154935594.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadj-
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjGY
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjJ
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjb
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjd
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadjz
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadl
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlI#
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadle
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadlr1
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadm
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmA
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadmB
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadma
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadn
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005324000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloado
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadob
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadocati
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadom
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadonb/
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadort=d
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadou
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadox
Source: Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp%
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadp;
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadpa
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadps=
Source: Synaptics.exe, 00000004.00000002.2398988499.0000000007588000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154935594.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq
Source: Synaptics.exe, 00000004.00000002.2401328312.000000000799E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadq$$
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqG
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqb
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqd
Source: Synaptics.exe, 00000004.00000002.2401434889.0000000007C1E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396056277.000000000430E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2401549375.0000000007E9E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqtzq
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadqz/
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadr
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrc
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadre
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrse
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadrt=dZC=
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloads
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadsH.
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadt8.
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtF
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtM
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtce
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtfor
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadth:
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadtp9
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduB
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloaduD
Source: Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwBov9
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwa
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadwc
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx
Source: Synaptics.exe, 00000004.00000002.2409559052.000000000FE6E000.00000004.00000010.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadx.7
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxB
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadxa
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloady
Source: Synaptics.exe, 00000004.00000002.2396842669.00000000052CF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyC
Source: Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadyc
Source: Synaptics.exe, 00000004.00000002.2408827318.000000000EEEF000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadye
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.00000000075E8000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.000000000769D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadz
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005367000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadzx$
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~-
Source: Synaptics.exe, 00000004.00000002.2399690937.000000000764F000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~H5
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007BC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download~M
Source: MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloX
Source: MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloXO
Source: 674551.msi.1.dr	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=download
Source: Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://docs.google.com/uc?id=0BxsMXGfPIZfSVzUyaHFYVkQxeFk&export=downloadN
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/A
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2408055892.000000000EECE000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2408055892.000000000EE32000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154958231.000000000533C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2408827318.000000000EF0C000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2408055892.000000000EE58000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4Qg
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download4Qg7
Source: Synaptics.exe, 00000004.00000002.2396842669.000000000535D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download_
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadf
Source: Synaptics.exe, 00000004.00000002.2396842669.000000000535D000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadg
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadu
Source: Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=downloadw
Source: Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	String found in binary or memory: https://drive.usercontent.google.com/k
Source: MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=
Source: 674551.msi.1.dr	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1
Source: Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:
Source: 674551.msi.1.dr	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1
Source: Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16
Source: MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlX
Source: 674551.msi.1.dr	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1
Source: Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	String found in binary or memory: https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:

Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49744
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49865
Source: unknown	Network traffic detected: HTTP traffic on port 49890 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49743
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49864
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49863
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49861
Source: unknown	Network traffic detected: HTTP traffic on port 49766 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49743 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49875 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49746 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49878 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49769 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49720 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49795 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49738
Source: unknown	Network traffic detected: HTTP traffic on port 49717 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49737
Source: unknown	Network traffic detected: HTTP traffic on port 49849 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49735
Source: unknown	Network traffic detected: HTTP traffic on port 49772 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49733
Source: unknown	Network traffic detected: HTTP traffic on port 49841 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49889 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49731
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49730
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49850
Source: unknown	Network traffic detected: HTTP traffic on port 49728 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49749 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49763 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49806 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49728
Source: unknown	Network traffic detected: HTTP traffic on port 49777 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49849
Source: unknown	Network traffic detected: HTTP traffic on port 49861 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49714 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49847
Source: unknown	Network traffic detected: HTTP traffic on port 49735 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49725
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49846
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49724
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49723
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49722
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49721
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49720
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49841
Source: unknown	Network traffic detected: HTTP traffic on port 49731 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49840
Source: unknown	Network traffic detected: HTTP traffic on port 49873 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49748 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49745 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49828 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49793 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49850 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49805 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49719
Source: unknown	Network traffic detected: HTTP traffic on port 49751 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49839
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49717
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49838
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49716
Source: unknown	Network traffic detected: HTTP traffic on port 49715 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49847 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49715
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49714
Source: unknown	Network traffic detected: HTTP traffic on port 49709 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49710
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49830
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49796
Source: unknown	Network traffic detected: HTTP traffic on port 49839 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49864 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49795
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49793
Source: unknown	Network traffic detected: HTTP traffic on port 49814 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49765 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49723 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49796 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49709
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49829
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49828
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49827
Source: unknown	Network traffic detected: HTTP traffic on port 49754 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49737 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49771 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49733 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49788
Source: unknown	Network traffic detected: HTTP traffic on port 49865 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49710 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49779 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49813 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49807 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49776 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49816
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49815
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49814
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49813
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49779
Source: unknown	Network traffic detected: HTTP traffic on port 49885 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49778
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49777
Source: unknown	Network traffic detected: HTTP traffic on port 49816 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49776
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49772
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49771
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49770
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49890
Source: unknown	Network traffic detected: HTTP traffic on port 49788 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49724 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49767 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49721 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49827 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49830 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49807
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49806
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49805
Source: unknown	Network traffic detected: HTTP traffic on port 49882 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49804
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49769
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49889
Source: unknown	Network traffic detected: HTTP traffic on port 49756 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49767
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49766
Source: unknown	Network traffic detected: HTTP traffic on port 49758 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49765
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49764
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49885
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49763
Source: unknown	Network traffic detected: HTTP traffic on port 49838 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49863 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49882
Source: unknown	Network traffic detected: HTTP traffic on port 49815 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49840 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49725 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49764 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49770 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49719 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49722 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49778 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49758
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49878
Source: unknown	Network traffic detected: HTTP traffic on port 49738 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49755 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49756
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49755
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49754
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49875
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49874
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49873
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49751
Source: unknown	Network traffic detected: HTTP traffic on port 49730 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49750
Source: unknown	Network traffic detected: HTTP traffic on port 49874 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49804 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49744 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49829 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49716 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 49750 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49749
Source: unknown	Network traffic detected: HTTP traffic on port 49846 -> 443
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49748
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49746
Source: unknown	Network traffic detected: HTTP traffic on port 443 -> 49745

Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49709 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49710 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49714 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49717 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49716 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49715 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49719 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49720 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49730 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49731 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49743 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49745 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49748 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49750 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49754 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49755 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49764 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49767 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49770 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49769 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49776 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49777 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49788 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49793 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49795 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.129:443 -> 192.168.2.5:49796 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49806 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49805 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49813 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49815 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49827 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49828 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49838 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49839 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49847 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49846 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49861 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49863 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49882 version: TLS 1.2
Source: unknown	HTTPS traffic detected: 142.250.186.174:443 -> 192.168.2.5:49885 version: TLS 1.2

System Summary

Document contains an embedded VBA macro with suspicious strings

Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: FN = Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe"
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set myWS = CreateObject("WScript.Shell")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: TMP = Environ("Temp") & "\~$cache1.exe"
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: If FSO.FileExists(Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe") Then
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Shell Environ("ALLUSERSPROFILE") & "\Synaptics\Synaptics.exe", vbHide
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: ElseIf FSO.FileExists(Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe") Then
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Shell Environ("WINDIR") & "\System32\Synaptics\Synaptics.exe", vbHide
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5.1")
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Set WinHttpReq = CreateObject("WinHttp.WinHttpRequest.5")

Document contains an embedded VBA with functions possibly related to ADO stream file operations

Source: EbdP5pVY.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write
Source: NVWZAPQSQL.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'ADODB.Stream' functions open, read, savetofile, write

Document contains an embedded VBA with functions possibly related to HTTP operations

Source: EbdP5pVY.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send
Source: NVWZAPQSQL.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'XMLHttpRequest' functions response, responsebody, responsetext, status, open, send

Document contains an embedded VBA with functions possibly related to WSH operations (process, registry, environment, or keystrokes)

Source: EbdP5pVY.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ
Source: NVWZAPQSQL.xlsm.4.dr	Stream path 'VBA/ThisWorkbook' : found possibly 'WScript.Shell' functions regread, regwrite, environ

Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\674551.msi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\inprogressinstallinfo.ipi	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6}	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4699.tmp	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4755.tmp	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File created: C:\Windows\SysWOW64\._cache_MSI4755.tmp	Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File deleted: C:\Windows\Installer\MSI4755.tmp

Jump to behavior

Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: EbdP5pVY.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_Open()
Source: NVWZAPQSQL.xlsm.4.dr	OLE, VBA macro line: Private Sub Workbook_BeforeClose(Cancel As Boolean)

Source: Joe Sandbox View	Dropped File: C:\ProgramData\Synaptics\RCX49C5.tmp 449B6A3E32CEB8FC953EAF031B3E0D6EC9F2E59521570383D08DC57E5FFA3E19
Source: Joe Sandbox View	Dropped File: C:\ProgramData\Synaptics\Synaptics.exe C1317DA0FD0DC3D73B38634EA586016F6F651F52ACC576FBAE8B82721C83E9AE

Source: C:\ProgramData\Synaptics\Synaptics.exe

Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 3156

Source: MSI4755.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: MSI4755.tmp.1.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: Synaptics.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Source: Synaptics.exe.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: RCX49C5.tmp.3.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows
Source: ~$cache1.4.dr	Static PE information: Resource name: RT_RCDATA type: PE32 executable (DLL) (GUI) Intel 80386, for MS Windows

Source: valyzt.msi	Binary or memory string: OriginalFileName vs valyzt.msi
Source: valyzt.msi	Binary or memory string: OriginalFilenameb! vs valyzt.msi

Source: classification engine

Classification label: mal100.troj.expl.evad.winMSI@9/58@8/3

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File created: C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\Office\Heartbeat\HeartbeatCache.xml

Jump to behavior

Source: C:\Windows\System32\msiexec.exe

File created: C:\Users\user\AppData\Roaming\Microsoft\CML4745.tmp

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Mutant created: \Sessions\1\BaseNamedObjects\Synaptics2X
Source: C:\Windows\SysWOW64\WerFault.exe	Mutant created: \Sessions\1\BaseNamedObjects\Local\WERReportingForProcess6520

Source: C:\Windows\System32\msiexec.exe

File created: C:\Windows\TEMP\~DF044B9400AF3F8FCD.TMP

Jump to behavior

Source: Yara match	File source: valyzt.msi, type: SAMPLE
Source: Yara match	File source: 3.0.MSI4755.tmp.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: C:\Users\user\Documents\EEGWXUHVUG\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX49C5.tmp, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI4699.tmp, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\674551.msi, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI4755.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Source: C:\Windows\Installer\MSI4755.tmp	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Key opened: HKEY_CURRENT_USER\Software\Borland\Delphi\Locales	Jump to behavior

Source: C:\Windows\Installer\MSI4755.tmp

File read: C:\Users\user\Desktop\desktop.ini

Jump to behavior

Source: C:\Windows\Installer\MSI4755.tmp

Key opened: HKEY_CURRENT_USER\Software\Policies\Microsoft\Windows\Safer\CodeIdentifiers

Jump to behavior

Source: valyzt.msi	Virustotal: Detection: 70%
Source: valyzt.msi	ReversingLabs: Detection: 65%

Source: unknown	Process created: C:\Windows\System32\msiexec.exe "C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\valyzt.msi"
Source: unknown	Process created: C:\Windows\System32\msiexec.exe C:\Windows\system32\msiexec.exe /V
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI4755.tmp "C:\Windows\Installer\MSI4755.tmp"
Source: C:\Windows\Installer\MSI4755.tmp	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Source: unknown	Process created: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Source: unknown	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe"
Source: C:\ProgramData\Synaptics\Synaptics.exe	Process created: C:\Windows\SysWOW64\WerFault.exe C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 3156
Source: C:\Windows\System32\msiexec.exe	Process created: C:\Windows\Installer\MSI4755.tmp "C:\Windows\Installer\MSI4755.tmp"	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate	Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srpapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textinputframework.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coreuicomponents.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: coremessaging.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: aclayers.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: tsappcmp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wkscli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: srclient.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: spp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: powrprof.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vssapi.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vsstrace.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: umpdc.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mscoree.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: vcruntime140_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ucrtbase_clr0400.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: rstrtmgr.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: pcacli.dll	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Section loaded: mpr.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: apphelp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: version.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: wininet.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: wsock32.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: netapi32.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: wldp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: textshaping.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: propsys.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: profapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: windows.staterepositoryps.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: appresolver.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: bcp47langs.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: slc.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: userenv.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: sppc.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: windows.fileexplorer.common.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: iertutil.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: twinapi.appcore.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: twext.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: policymanager.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: msvcp110_win.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: ntshrui.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: sspicli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: srvcli.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: cscapi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: starttiledata.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: acppage.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: sfc.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: msi.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: aepic.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: sfc_os.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: edputil.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: urlmon.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: netutils.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: wintypes.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: onecorecommonproxystub.dll	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Section loaded: onecoreuapcommonproxystub.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: apphelp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: profapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: propsys.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntmarta.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iertutil.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: sspicli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ondemandconnroutehelper.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winhttp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: iphlpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mswsock.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winnsi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: urlmon.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: srvcli.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netutils.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dnsapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rasadhlp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: fwpuclnt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: schannel.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: mskeyprotect.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ntasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: msasn1.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: dpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: rsaenh.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: cryptbase.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: gpapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncrypt.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: ncryptsslp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: napinsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: pnrpnsp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wshbth.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: nlaapi.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: winrnr.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: version.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wininet.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wsock32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: netapi32.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: uxtheme.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: windows.storage.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: wldp.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: kernel.appcore.dll	Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Section loaded: textshaping.dll	Jump to behavior

Source: C:\Windows\Installer\MSI4755.tmp

Key value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{20D04FE0-3AEA-1069-A2D8-08002B30309D}\InProcServer32

Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe

File written: C:\Users\user\AppData\Local\Temp\uVJsIeF.ini

Jump to behavior

Source: Window Recorder

Window detected: More than 3 window changes detected

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

Key opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common

Jump to behavior

Source: valyzt.msi

Static file information: File size 1748992 > 1048576

Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE

File opened: C:\Program Files (x86)\Microsoft Office\root\vfs\SystemX86\MSVCR100.dll

Jump to behavior

Source: initial sample	Static PE information: section name: UPX0
Source: initial sample	Static PE information: section name: UPX1

Persistence and Installation Behavior

Drops PE files to the document folder of the user

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\EEGWXUHVUG\~$cache1

Jump to dropped file

Drops executables to the windows directory (C:\Windows) and starts them

Source: C:\Windows\System32\msiexec.exe

Executable created and started: C:\Windows\Installer\MSI4755.tmp

Jump to behavior

Source: C:\Windows\Installer\MSI4755.tmp	File created: C:\Windows\SysWOW64\._cache_MSI4755.tmp	Jump to dropped file
Source: C:\Windows\Installer\MSI4755.tmp	File created: C:\ProgramData\Synaptics\Synaptics.exe	Jump to dropped file
Source: C:\ProgramData\Synaptics\Synaptics.exe	File created: C:\Users\user\Documents\EEGWXUHVUG\~$cache1	Jump to dropped file
Source: C:\Windows\Installer\MSI4755.tmp	File created: C:\ProgramData\Synaptics\RCX49C5.tmp	Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4755.tmp	Jump to dropped file

Source: C:\Windows\Installer\MSI4755.tmp	File created: C:\ProgramData\Synaptics\Synaptics.exe			Jump to dropped file
Source: C:\Windows\Installer\MSI4755.tmp	File created: C:\ProgramData\Synaptics\RCX49C5.tmp			Jump to dropped file

Source: C:\Windows\Installer\MSI4755.tmp	File created: C:\Windows\SysWOW64\._cache_MSI4755.tmp			Jump to dropped file
Source: C:\Windows\System32\msiexec.exe	File created: C:\Windows\Installer\MSI4755.tmp			Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe

File created: C:\Users\user\Documents\EEGWXUHVUG\~$cache1

Jump to dropped file

Source: C:\Windows\Installer\MSI4755.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Registry value created or modified: HKEY_LOCAL_MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver			Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\AutoUpdate			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Registry key monitored for changes: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	Process information set: NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: FAILCRITICALERRORS \| NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: FAILCRITICALERRORS \| NOGPFAULTERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior
Source: C:\Windows\SysWOW64\WerFault.exe	Process information set: NOOPENFILEERRORBOX	Jump to behavior

Source: C:\Windows\Installer\MSI4755.tmp

Dropped PE file which has not been started: C:\Windows\SysWOW64\._cache_MSI4755.tmp

Jump to dropped file

Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 5980	Thread sleep time: -1020000s >= -30000s			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe TID: 8088	Thread sleep time: -60000s >= -30000s			Jump to behavior

Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior
Source: C:\Windows\System32\msiexec.exe	File Volume queried: C:\ FullSizeInformation	Jump to behavior

Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior
Source: C:\ProgramData\Synaptics\Synaptics.exe	Thread delayed: delay time: 60000			Jump to behavior

Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData\Roaming	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	Jump to behavior
Source: C:\Windows\Installer\MSI4755.tmp	File opened: C:\Users\user\AppData\Roaming\Microsoft\Internet Explorer	Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: VMware
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual USB Mouse
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin
Source: Amcache.hve.12.dr	Binary or memory string: VMware, Inc.
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1hbin@
Source: Amcache.hve.12.dr	Binary or memory string: c:\windows\system32\driverstore\filerepository\vmci.inf_amd64_68ed49469341f563
Source: Amcache.hve.12.dr	Binary or memory string: Ascsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: .Z$c:/windows/system32/drivers/vmci.sys
Source: Synaptics.exe, 00000004.00000002.2395079370.00000000007A7000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.0000000000793000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW
Source: Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAWvf
Source: Amcache.hve.12.dr	Binary or memory string: :scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: Hyper-V RAW(
Source: Amcache.hve.12.dr	Binary or memory string: pci\ven_15ad&dev_0740&subsys_074015ad,pci\ven_15ad&dev_0740,root\vmwvmcihostdev
Source: Amcache.hve.12.dr	Binary or memory string: c:/windows/system32/drivers/vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: scsi/cdrom&ven_necvmwar&prod_vmware_sata_cd00/4&224f42ef&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: vmci.sys
Source: Amcache.hve.12.dr	Binary or memory string: VMware-56 4d 43 71 48 15 3d ed-ae e6 c7 5a ec d9 3b f0
Source: Amcache.hve.12.dr	Binary or memory string: vmci.syshbin`
Source: Amcache.hve.12.dr	Binary or memory string: \driver\vmci,\driver\pci
Source: Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp	Binary or memory string: \\?\SCSI#CdRom&Ven_NECVMWar&Prod_VMware_SATA_CD00#4&224f42ef&0&000000#{53f5630d-b6bf-11d0-94f2-00a0c91efb8b}\\\?\Volume{a33c736e-61ca-11ee-8c18-806e6f6e6963}\
Source: Amcache.hve.12.dr	Binary or memory string: scsi/disk&ven_vmware&prod_virtual_disk/4&1656f219&0&000000
Source: Amcache.hve.12.dr	Binary or memory string: VMware20,1
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Generation Counter
Source: Amcache.hve.12.dr	Binary or memory string: NECVMWar VMware SATA CD00
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual disk SCSI Disk Device
Source: Amcache.hve.12.dr	Binary or memory string: scsi\cdromnecvmwarvmware_sata_cd001.00,scsi\cdromnecvmwarvmware_sata_cd00,scsi\cdromnecvmwar,scsi\necvmwarvmware_sata_cd001,necvmwarvmware_sata_cd001,gencdrom
Source: Amcache.hve.12.dr	Binary or memory string: scsi\diskvmware__virtual_disk____2.0_,scsi\diskvmware__virtual_disk____,scsi\diskvmware__,scsi\vmware__virtual_disk____2,vmware__virtual_disk____2,gendisk
Source: Amcache.hve.12.dr	Binary or memory string: Microsoft Hyper-V Virtualization Infrastructure Driver
Source: Amcache.hve.12.dr	Binary or memory string: VMware PCI VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware VMCI Bus Device
Source: Amcache.hve.12.dr	Binary or memory string: VMware Virtual RAM
Source: Amcache.hve.12.dr	Binary or memory string: BiosVendor:VMware, Inc.,BiosVersion:VMW201.00V.20829224.B64.2211211842,BiosReleaseDate:11/21/2022,BiosMajorRelease:0xff,BiosMinorRelease:0xff,SystemManufacturer:VMware, Inc.,SystemProduct:VMware20,1,SystemFamily:,SystemSKUNumber:,BaseboardManufacturer:,BaseboardProduct:,BaseboardVersion:,EnclosureType:0x1
Source: Amcache.hve.12.dr	Binary or memory string: vmci.inf_amd64_68ed49469341f563

Source: C:\Windows\System32\msiexec.exe

Process information queried: ProcessInformation

Jump to behavior

Source: C:\Windows\Installer\MSI4755.tmp

Process created: C:\ProgramData\Synaptics\Synaptics.exe "C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate

Jump to behavior

Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior
Source: C:\Windows\System32\msiexec.exe	Queries volume information: C:\ VolumeInformation			Jump to behavior

Source: Amcache.hve.12.dr	Binary or memory string: c:\programdata\microsoft\windows defender\platform\4.18.23080.2006-0\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: c:\program files\windows defender\msmpeng.exe
Source: Amcache.hve.12.dr	Binary or memory string: MsMpEng.exe

Stealing of Sensitive Information

Yara detected XRed

Source: Yara match	File source: valyzt.msi, type: SAMPLE
Source: Yara match	File source: 3.0.MSI4755.tmp.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2105707960.0000000000773000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSI4755.tmp PID: 1124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 6520, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Documents\EEGWXUHVUG\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX49C5.tmp, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI4699.tmp, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\674551.msi, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI4755.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Remote Access Functionality

Yara detected XRed

Source: Yara match	File source: valyzt.msi, type: SAMPLE
Source: Yara match	File source: 3.0.MSI4755.tmp.400000.0.unpack, type: UNPACKEDPE
Source: Yara match	File source: 00000004.00000003.2105707960.0000000000773000.00000004.00000020.00020000.00000000.sdmp, type: MEMORY
Source: Yara match	File source: 00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp, type: MEMORY
Source: Yara match	File source: Process Memory Space: MSI4755.tmp PID: 1124, type: MEMORYSTR
Source: Yara match	File source: Process Memory Space: Synaptics.exe PID: 6520, type: MEMORYSTR
Source: Yara match	File source: C:\Users\user\Documents\EEGWXUHVUG\~$cache1, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\RCX49C5.tmp, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI4699.tmp, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\674551.msi, type: DROPPED
Source: Yara match	File source: C:\Windows\Installer\MSI4755.tmp, type: DROPPED
Source: Yara match	File source: C:\ProgramData\Synaptics\Synaptics.exe, type: DROPPED

Mitre Att&ck Matrix

Reconnaissance	Resource Development	Initial Access	Execution	Persistence	Privilege Escalation	Defense Evasion	Credential Access	Discovery	Lateral Movement	Collection	Command and Control	Exfiltration	Impact
Gather Victim Identity Information	41 Scripting	2 Replication Through Removable Media	Windows Management Instrumentation	41 Scripting	11 Process Injection	132 Masquerading	OS Credential Dumping	1 Query Registry	Remote Services	Data from Local System	1 Encrypted Channel	Exfiltration Over Other Network Medium	Abuse Accessibility Features
Credentials	Domains	Default Accounts	Scheduled Task/Job	1 Registry Run Keys / Startup Folder	1 Registry Run Keys / Startup Folder	11 Virtualization/Sandbox Evasion	LSASS Memory	111 Security Software Discovery	Remote Desktop Protocol	Data from Removable Media	3 Ingress Tool Transfer	Exfiltration Over Bluetooth	Network Denial of Service
Email Addresses	DNS Server	Domain Accounts	At	1 DLL Side-Loading	1 DLL Side-Loading	11 Process Injection	Security Account Manager	1 Process Discovery	SMB/Windows Admin Shares	Data from Network Shared Drive	3 Non-Application Layer Protocol	Automated Exfiltration	Data Encrypted for Impact
Employee Names	Virtual Private Server	Local Accounts	Cron	Login Hook	1 Extra Window Memory Injection	1 Obfuscated Files or Information	NTDS	11 Virtualization/Sandbox Evasion	Distributed Component Object Model	Input Capture	34 Application Layer Protocol	Traffic Duplication	Data Destruction
Gather Victim Network Information	Server	Cloud Accounts	Launchd	Network Logon Script	Network Logon Script	1 Software Packing	LSA Secrets	11 Peripheral Device Discovery	SSH	Keylogging	Fallback Channels	Scheduled Transfer	Data Encrypted for Impact
Domain Properties	Botnet	Replication Through Removable Media	Scheduled Task	RC Scripts	RC Scripts	1 DLL Side-Loading	Cached Domain Credentials	3 File and Directory Discovery	VNC	GUI Input Capture	Multiband Communication	Data Transfer Size Limits	Service Stop
DNS	Web Services	External Remote Services	Systemd Timers	Startup Items	Startup Items	1 File Deletion	DCSync	13 System Information Discovery	Windows Remote Management	Web Portal Capture	Commonly Used Port	Exfiltration Over C2 Channel	Inhibit System Recovery
Network Trust Dependencies	Serverless	Drive-by Compromise	Container Orchestration Job	Scheduled Task/Job	Scheduled Task/Job	1 Extra Window Memory Injection	Proc Filesystem	System Owner/User Discovery	Cloud Services	Credential API Hooking	Application Layer Protocol	Exfiltration Over Alternative Protocol	Defacement

Behavior Graph

Hide Legend

Legend:

Process
Signature
Created File
DNS/IP Info
Is Dropped
Is Windows Process
Number of created Registry Values
Number of created Files
Visual Basic
Delphi
Java
.Net C# or VB.NET
C, C++ or other language
Is malicious
Internet

Source	Detection	Scanner	Label	Link
valyzt.msi	70%	Virustotal		Browse
valyzt.msi	66%	ReversingLabs	Win32.Trojan.Synaptics

Dropped Files

Source	Detection	Scanner	Label
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\Synaptics.exe	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Users\user\Documents\EEGWXUHVUG\~$cache1	100%	Avira	TR/Dldr.Agent.SH
C:\Users\user\Documents\EEGWXUHVUG\~$cache1	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Windows\Installer\MSI4755.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\Windows\Installer\MSI4755.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\ProgramData\Synaptics\RCX49C5.tmp	100%	Avira	TR/Dldr.Agent.SH
C:\ProgramData\Synaptics\RCX49C5.tmp	100%	Avira	W2000M/Dldr.Agent.17651006
C:\Windows\SysWOW64\._cache_MSI4755.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\Synaptics.exe	100%	Joe Sandbox ML
C:\Users\user\Documents\EEGWXUHVUG\~$cache1	100%	Joe Sandbox ML
C:\Windows\Installer\MSI4755.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCX49C5.tmp	100%	Joe Sandbox ML
C:\ProgramData\Synaptics\RCX49C5.tmp	92%	ReversingLabs	Win32.Worm.Zorex
C:\ProgramData\Synaptics\Synaptics.exe	92%	ReversingLabs	Win32.Trojan.Synaptics
C:\Users\user\Documents\EEGWXUHVUG\~$cache1	92%	ReversingLabs	Win32.Worm.Zorex
C:\Windows\Installer\MSI4755.tmp	92%	ReversingLabs	Win32.Trojan.Synaptics
C:\Windows\SysWOW64\._cache_MSI4755.tmp	55%	ReversingLabs	Win32.Trojan.Lisk

Source	Detection	Scanner	Label	Link
http://xred.site50.net/syn/Synaptics.rarh	100%	Avira URL Cloud	malware
http://xred.site50.net/syn/SSLLibrary.dlD	100%	Avira URL Cloud	malware

Domains and IPs

Contacted Domains

Name	IP	Active	Malicious	Reputation
freedns.afraid.org	69.42.215.252	true	false	high
docs.google.com	142.250.186.174	true	false	high
s-part-0017.t-0009.t-msedge.net	13.107.246.45	true	false	high
s-part-0017.t-0009.fb-t-msedge.net	13.107.253.45	true	false	high
drive.usercontent.google.com	142.250.186.129	true	false	high
18.31.95.13.in-addr.arpa	unknown	unknown	false	high
xred.mooo.com	unknown	unknown	false	high

Contacted URLs

Name	Malicious	Antivirus Detection	Reputation
xred.mooo.com	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978	false		high

URLs from Memory and Binaries

Name	Source	Malicious	Antivirus Detection	Reputation
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=	MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/project.org.cn	Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEV	Synaptics.exe, 00000004.00000002.2396842669.0000000005318000.00000004.00000020.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/k	Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rarZ	Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=1	674551.msi.1.dr	false		high
https://docs.google.com/syndication-cn.com	Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978h	Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/.youtubeeducatiZ	Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/r	Synaptics.exe, 00000004.00000002.2408827318.000000000EF1E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/.googl.	Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1:	Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://upx.sf.net	Amcache.hve.12.dr	false		high
http://xred.site50.net/syn/Synaptics.rar	674551.msi.1.dr	false		high
https://docs.google.com/imiz	Synaptics.exe, 00000004.00000002.2399690937.00000000076E9000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/Synaptics.rarh	MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://docs.google.com/bleclick.cn	Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/	Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2408827318.000000000EF1E000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dlX	MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dll6	Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1:	Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dlD	MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	false	Avira URL Cloud: malware	unknown
https://www.dropbox.com/s/fzj752whr3ontsm/SSLLibrary.dll?dl=1	674551.msi.1.dr	false		high
https://www.dropbox.com/s/zhp1b06imehwylq/Synaptics.rar?dl=1	674551.msi.1.dr	false		high
https://docs.google.com/ube.com	Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&	Synaptics.exe, 00000004.00000002.2403570018.000000000AA5E000.00000004.00000010.00020000.00000000.sdmp	false		high
https://drive.usercontent.google.com/A	Synaptics.exe, 00000004.00000002.2396842669.0000000005280000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/Microsoft	Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.iniZ	Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/e?M	Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SUpdate.ini	674551.msi.1.dr	false		high
https://docs.google.com/R	Synaptics.exe, 00000004.00000002.2395079370.000000000074A000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/apps.cn	Synaptics.exe, 00000004.00000003.2154822323.00000000007CC000.00000004.00000020.00020000.00000000.sdmp	false		high
https://docs.google.com/M	Synaptics.exe, 00000004.00000003.2154958231.0000000005318000.00000004.00000020.00020000.00000000.sdmp	false		high
https://www.dropbox.com/s/n1w4p8gc6jzo0sg/SUpdate.ini?dl=16	Synaptics.exe, 00000004.00000002.2395642291.00000000022A0000.00000004.00001000.00020000.00000000.sdmp	false		high
https://docs.google.com/uc?id=0;	Synaptics.exe, 00000004.00000002.2412059221.0000000012C3E000.00000004.00000010.00020000.00000000.sdmp, Synaptics.exe, 00000004.00000002.2409682805.00000000100EE000.00000004.00000010.00020000.00000000.sdmp	false		high
http://freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978x	MSI4755.tmp, 00000003.00000003.2049403724.0000000002210000.00000004.00001000.00020000.00000000.sdmp	false		high
http://xred.site50.net/syn/SSLLibrary.dll	674551.msi.1.dr	false		high

World Map of Contacted IPs

No. of IPs < 25%
25% < No. of IPs < 50%
50% < No. of IPs < 75%
75% < No. of IPs

Public IPs

IP	Domain	Country	ASN	ASN Name	Malicious
142.250.186.129	drive.usercontent.google.com	United States	15169	GOOGLEUS	false
142.250.186.174	docs.google.com	United States	15169	GOOGLEUS	false
69.42.215.252	freedns.afraid.org	United States	17048	AWKNET-LLCUS	false

General Information

Joe Sandbox version:	41.0.0 Charoite
Analysis ID:	1582346
Start date and time:	2024-12-30 11:45:23 +01:00
Joe Sandbox product:	CloudBasic
Overall analysis duration:	0h 5m 55s
Hypervisor based Inspection enabled:	false
Report type:	full
Cookbook file name:	defaultwindowsofficecookbook.jbs
Analysis system description:	Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
Run name:	Without Instrumentation
Number of analysed new started processes analysed:	14
Number of new started drivers analysed:	0
Number of existing processes analysed:	0
Number of existing drivers analysed:	0
Number of injected processes analysed:	0
Technologies:	HCA enabled EGA enabled AMSI enabled
Analysis Mode:	default
Analysis stop reason:	Timeout
Sample name:	valyzt.msi
Detection:	MAL
Classification:	mal100.troj.expl.evad.winMSI@9/58@8/3
EGA Information:	Failed
HCA Information:	Successful, ratio: 100% Number of executed functions: 0 Number of non-executed functions: 0
Cookbook Comments:	Found application associated with file extension: .msi Close Viewer

Warnings

Exclude process from analysis (whitelisted): dllhost.exe, WerFault.exe, WMIADAP.exe, SIHClient.exe, svchost.exe
Excluded IPs from analysis (whitelisted): 52.109.89.18, 184.28.90.27, 52.113.194.132, 52.168.117.169, 20.42.73.29, 40.126.32.76, 4.175.87.197, 13.107.246.45, 13.95.31.18, 20.12.23.50, 13.107.253.45
Excluded domains from analysis (whitelisted): azurefd-t-fb-prod.trafficmanager.net, slscr.update.microsoft.com, otelrules.afd.azureedge.net, onedscolprdeus10.eastus.cloudapp.azure.com, weu-azsc-config.officeapps.live.com, fs-wildcard.microsoft.com.edgekey.net, fs-wildcard.microsoft.com.edgekey.net.globalredir.akadns.net, ecs-office.s-0005.s-msedge.net, ocsp.digicert.com, login.live.com, e16604.g.akamaiedge.net, onedsblobprdeus15.eastus.cloudapp.azure.com, officeclient.microsoft.com, prod.fs.microsoft.com.akadns.net, ecs.office.com, self-events-data.trafficmanager.net, fs.microsoft.com, otelrules.azureedge.net, prod.configsvc1.live.com.akadns.net, self.events.data.microsoft.com, ctldl.windowsupdate.com, s-0005-office.config.skype.com, fe3cr.delivery.mp.microsoft.com, s-0005.s-msedge.net, config.officeapps.live.com, blobcollector.events.data.trafficmanager.net, azureedge-t-prod.trafficmanager.net, umwatson.events.data.microsoft.com, ecs.office.trafficmanager.net, europe.configsvc1.live.com.akadns.net
Execution Graph export aborted for target Synaptics.exe, PID 6520 because there are no executed function
Report size getting too big, too many NtCreateKey calls found.
Report size getting too big, too many NtDeviceIoControlFile calls found.
Report size getting too big, too many NtOpenKeyEx calls found.
Report size getting too big, too many NtProtectVirtualMemory calls found.
Report size getting too big, too many NtQueryAttributesFile calls found.
Report size getting too big, too many NtQueryValueKey calls found.
Report size getting too big, too many NtReadVirtualMemory calls found.
Report size getting too big, too many NtSetInformationFile calls found.

Simulations

Behavior and APIs

Time	Type	Description
05:46:20	API Interceptor	193x Sleep call for process: Synaptics.exe modified
05:46:49	API Interceptor	1x Sleep call for process: WerFault.exe modified
11:46:16	Autostart	Run: HKLM\Software\Microsoft\Windows\CurrentVersion\Run Synaptics Pointing Device Driver C:\ProgramData\Synaptics\Synaptics.exe

Joe Sandbox View / Context

IPs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
69.42.215.252	New PO - Supplier 16-12-2024-Pdf.exe	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	Purchase-Order.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	docx.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	hoaiuy.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	222.msi	Get hash	malicious	XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	freedns.afraid.org/api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978

Domains

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
s-part-0017.t-0009.t-msedge.net	Purchase-Order.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	sdlvrr.msi	Get hash	malicious	LodaRAT	Browse	13.107.246.45
	docx.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	hoaiuy.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	222.msi	Get hash	malicious	XRed	Browse	13.107.246.45
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.246.45
	Machine-PO.exe	Get hash	malicious	XRed	Browse	13.107.246.45
	universityform.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
	universityform.xlsm	Get hash	malicious	Unknown	Browse	13.107.246.45
s-part-0017.t-0009.fb-t-msedge.net	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	13.107.253.45
	Salary Amendment.xlsx	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	IcisR4FC8n.dll	Get hash	malicious	Unknown	Browse	13.107.253.45
	https://thaykinhgiasoc.com/o/?c3Y9bzM2NV8xX25vbSZyYW5kPU9USlBZakE9JnVpZD1VU0VSMTcxMDIwMjRVMDAxMDE3NDA=N0123N	Get hash	malicious	HTMLPhisher, Mamba2FA	Browse	13.107.253.45
	file.exe	Get hash	malicious	LummaC, Stealc	Browse	13.107.253.45
	pzPO97QouM.exe	Get hash	malicious	ScreenConnect Tool	Browse	13.107.253.45
	Multi Graphics Inc CustomerVendor Form.pdf	Get hash	malicious	HTMLPhisher	Browse	13.107.253.45
	OaSEt8i2jE.exe	Get hash	malicious	Njrat	Browse	13.107.253.45
	https://eu.docworkspace.com/d/sIGWvrvOeAYXvpLkG	Get hash	malicious	Unknown	Browse	13.107.253.45
	PORgjGswYg.exe	Get hash	malicious	Unknown	Browse	13.107.253.45
freedns.afraid.org	New PO - Supplier 16-12-2024-Pdf.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase-Order.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	docx.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	hoaiuy.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	222.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

ASNs

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
AWKNET-LLCUS	New PO - Supplier 16-12-2024-Pdf.exe	Get hash	malicious	XRed	Browse	69.42.215.252
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	Purchase-Order.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	docx.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	hoaiuy.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	222.msi	Get hash	malicious	XRed	Browse	69.42.215.252
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	69.42.215.252

JA3 Fingerprints

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link	Context
37f463bf4616ecd445d4a1937da06e19	New PO - Supplier 16-12-2024-Pdf.exe	Get hash	malicious	XRed	Browse	142.250.186.129 142.250.186.174
	Supplier.bat	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.129 142.250.186.174
	Purchase-Order.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.129 142.250.186.174
	FGNEBI.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.129 142.250.186.174
	docx.msi	Get hash	malicious	XRed	Browse	142.250.186.129 142.250.186.174
	hoaiuy.msi	Get hash	malicious	XRed	Browse	142.250.186.129 142.250.186.174
	222.msi	Get hash	malicious	XRed	Browse	142.250.186.129 142.250.186.174
	LWQDFZ.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.129 142.250.186.174
	JPS.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.129 142.250.186.174
	KOGJZW.exe	Get hash	malicious	LodaRAT, XRed	Browse	142.250.186.129 142.250.186.174

Dropped Files

Match	Associated Sample Name / URL	SHA 256	Detection	Threat Name	Link
C:\ProgramData\Synaptics\RCX49C5.tmp	New PO - Supplier 16-12-2024-Pdf.exe	Get hash	malicious	XRed	Browse
	Purchase-Order.exe	Get hash	malicious	LodaRAT, XRed	Browse
	hoaiuy.msi	Get hash	malicious	XRed	Browse
	222.msi	Get hash	malicious	XRed	Browse
	Machine-PO.exe	Get hash	malicious	XRed	Browse
	222.exe	Get hash	malicious	LodaRAT, XRed	Browse
C:\ProgramData\Synaptics\Synaptics.exe	222.msi	Get hash	malicious	XRed	Browse
C:\ProgramData\Synaptics\Synaptics.exe	222.exe	Get hash	malicious	LodaRAT, XRed	Browse

Created / dropped Files

C:\Config.Msi\674553.rbs

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	modified
Size (bytes):	623
Entropy (8bit):	5.287178121825724
Encrypted:	false
SSDEEP:	12:Eg2Zg8mmIdFLXS/cqj//pFvfN2zWotHMphe2WmmY3HDyzgj8Q:agTPSkqjM65ptyzAL
MD5:	459D394068A571AE5F234AD08ACD8B01
SHA1:	59CED7D678875C829AE38116F8978EE2B323E168
SHA-256:	6716215C0FF560A6BE11B6CB95182294F106CAB102F6E06FA8C23D3D660225F1
SHA-512:	D07E45916ADA575E9D945D80BEBC351D5F009957274114049D4549D35DB4AF76ADAA7417DCEBB5C3F446103FDE1026BA5251A9CCDE9421811C7704246BE0A909
Malicious:	false
Reputation:	low
Preview:	...@IXOS.@.....@.-.Y.@.....@.....@.....@.....@.....@......&.{29EF7317-DCA1-4159-97B2-C883AD400AC6}..Exe to msi converter free..valyzt.msi.@.....@.....@.....@........&.{C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}.....@.....@.....@.....@.......@.....@.....@.......@......Exe to msi converter free......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]....ProcessComponents..Updating component registration..&.{4C231858-2B39-11D3-8E0D-00C04F6837D0}&.{29EF7317-DCA1-4159-97B2-C883AD400AC6}.@........RemoveODBC..Removing ODBC components..%._B3D13F97_1369_417D_A477_B4C42B829328...@.....@.....@....

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	118
Entropy (8bit):	3.5700810731231707
Encrypted:	false
SSDEEP:	3:QaklTlAlXMLLmHlIlFLlmIK/5lTn84vlJlhlXlDHlA6l3l6Als:QFulcLk04/5p8GVz6QRq
MD5:	573220372DA4ED487441611079B623CD
SHA1:	8F9D967AC6EF34640F1F0845214FBC6994C0CB80
SHA-256:	BE84B842025E4241BFE0C9F7B8F86A322E4396D893EF87EA1E29C74F47B6A22D
SHA-512:	F19FA3583668C3AF92A9CEF7010BD6ECEC7285F9C8665F2E9528DBA606F105D9AF9B1DB0CF6E7F77EF2E395943DC0D5CB37149E773319078688979E4024F9DD7
Malicious:	false
Reputation:	high, very likely benign file
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.H.e.a.r.t.b.e.a.t.C.a.c.h.e./.>.

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_e73781c637c020daee3de6ae263d2d0a91f2a4c_455b7b6e_f18e4e4d-ec94-425b-8f16-23e7406416c5\Report.wer

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	65536
Entropy (8bit):	1.1336482840498854
Encrypted:	false
SSDEEP:	192:sYOxVps9I40Kks/kDzJDzqjLOA/ytzxwzuiF5Z24IO8EKDzy:qy9WKksMJqj8KzuiF5Y4IO8zy
MD5:	62C2DF2F192BBC616A3887C6ECF05694
SHA1:	FDF285A7E236BF1474E5E69F0159CA32506E0B65
SHA-256:	2873A760F3B4C7199A0F7E4BD37590D0BCB446978E8FBE536B4CF73677305AC5
SHA-512:	CED1BDA38AB7CF758127720D4C7664870251C08B0FAD0DFE60B382E4D85B2C258E14383C2A6B13ED0FA434F6EDF150CF51C19671ACD68417C70F4CDC8A8883B4
Malicious:	false
Preview:	..V.e.r.s.i.o.n.=.1.....E.v.e.n.t.T.y.p.e.=.A.P.P.C.R.A.S.H.....E.v.e.n.t.T.i.m.e.=.1.3.3.8.0.0.2.9.2.0.2.0.5.3.9.5.7.0.....R.e.p.o.r.t.T.y.p.e.=.2.....C.o.n.s.e.n.t.=.1.....U.p.l.o.a.d.T.i.m.e.=.1.3.3.8.0.0.2.9.2.0.7.1.0.0.8.2.0.3.....R.e.p.o.r.t.S.t.a.t.u.s.=.5.2.4.3.8.4.....R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.f.1.8.e.4.e.4.d.-.e.c.9.4.-.4.2.5.b.-.8.f.1.6.-.2.3.e.7.4.0.6.4.1.6.c.5.....I.n.t.e.g.r.a.t.o.r.R.e.p.o.r.t.I.d.e.n.t.i.f.i.e.r.=.2.5.c.4.6.a.f.9.-.9.1.0.f.-.4.8.5.d.-.9.b.1.a.-.0.d.f.f.e.8.3.2.a.2.2.a.....W.o.w.6.4.H.o.s.t.=.3.4.4.0.4.....W.o.w.6.4.G.u.e.s.t.=.3.3.2.....N.s.A.p.p.N.a.m.e.=.S.y.n.a.p.t.i.c.s...e.x.e.....A.p.p.S.e.s.s.i.o.n.G.u.i.d.=.0.0.0.0.1.9.7.8.-.0.0.0.1.-.0.0.1.4.-.1.1.7.5.-.3.4.0.c.a.8.5.a.d.b.0.1.....T.a.r.g.e.t.A.p.p.I.d.=.W.:.0.0.0.6.b.9.9.a.1.3.7.d.5.9.3.d.d.a.9.d.1.5.8.d.c.8.b.6.b.7.7.2.0.d.e.b.0.0.0.0.1.f.0.4.!.0.0.0.0.6.c.2.b.a.a.7.2.e.a.5.d.0.8.b.6.5.8.3.8.9.3.b.0.1.0.0.1.e.5.4.0.2.1.3.f.4.a.a.f.!.S.y.n.a.p.t.i.c.s...e.x.e.....T.a.r.g.e.t.A.p.p.V.e.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB725.tmp.dmp

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	Mini DuMP crash report, 14 streams, Mon Dec 30 10:46:43 2024, 0x1205a4 type
Category:	dropped
Size (bytes):	2804156
Entropy (8bit):	1.9639427422256246
Encrypted:	false
SSDEEP:	6144:M7U+MT9D0gGXk/79xKABYGGknHw97srxmjhqHra5K7:M7UZD0xXk/79/hGkHDxmjhqv7
MD5:	74D5FB0F64C958AE25C0EC26319882B7
SHA1:	DB990B481C9D8AC29899B542AD0C6A6547EC8513
SHA-256:	8224F501C3A780550881F61DBAB0738097FDABB852205A907A0D4841E5954127
SHA-512:	DD24A81455F4F31DFA743C566B6AF7A7E51921EF04AEC8689298D3FB9F3C7C1E76491CDC8B259C09B78B9E8C97842616894A7F8C5BDBA4A8EA0F2552B38BB8BF
Malicious:	false
Preview:	MDMP..a..... ........zrg............T%..............\,.......c..r...........T.......8...........T.................)..........L...........M..............................................................................eJ.......N......GenuineIntel............T.......x....yrg.............................0..2...........,...E.a.s.t.e.r.n. .S.t.a.n.d.a.r.d. .T.i.m.e...........................................E.a.s.t.e.r.n. .S.u.m.m.e.r. .T.i.m.e...............................................1.9.0.4.1...1...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6...................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA02.tmp.WERInternalMetadata.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, Unicode text, UTF-16, little-endian text, with CRLF line terminators
Category:	dropped
Size (bytes):	6310
Entropy (8bit):	3.7139356200272085
Encrypted:	false
SSDEEP:	192:R6l7wVeJsxM6WycZYirJkfVpDb89b/jsf/1m:R6lXJb6GYGJkE/Ifg
MD5:	21404265B7832BF704D2D5D6BE96DA0E
SHA1:	C93EA74B8E1B637A6E189879DC39FCF9283E390C
SHA-256:	B53081DA28FE5778FDBBED4D3B6D4FACF9F52832B9087ABA048F8C5656BEFE38
SHA-512:	B8394B77EE35586BEC6F74E11FCA805EFD39534DD7C42892117F909DE569C0597ABEF6F866BC65A94142B072D579FDA12A75CFA12A5AF8EA0481DC6EB1EFD00C
Malicious:	false
Preview:	..<.?.x.m.l. .v.e.r.s.i.o.n.=.".1...0.". .e.n.c.o.d.i.n.g.=.".U.T.F.-.1.6.".?.>.....<.W.E.R.R.e.p.o.r.t.M.e.t.a.d.a.t.a.>.......<.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.........<.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.1.0...0.<./.W.i.n.d.o.w.s.N.T.V.e.r.s.i.o.n.>.........<.B.u.i.l.d.>.1.9.0.4.5.<./.B.u.i.l.d.>.........<.P.r.o.d.u.c.t.>.(.0.x.3.0.).:. .W.i.n.d.o.w.s. .1.0. .P.r.o.<./.P.r.o.d.u.c.t.>.........<.E.d.i.t.i.o.n.>.P.r.o.f.e.s.s.i.o.n.a.l.<./.E.d.i.t.i.o.n.>.........<.B.u.i.l.d.S.t.r.i.n.g.>.1.9.0.4.1...2.0.0.6...a.m.d.6.4.f.r.e...v.b._.r.e.l.e.a.s.e...1.9.1.2.0.6.-.1.4.0.6.<./.B.u.i.l.d.S.t.r.i.n.g.>.........<.R.e.v.i.s.i.o.n.>.2.0.0.6.<./.R.e.v.i.s.i.o.n.>.........<.F.l.a.v.o.r.>.M.u.l.t.i.p.r.o.c.e.s.s.o.r. .F.r.e.e.<./.F.l.a.v.o.r.>.........<.A.r.c.h.i.t.e.c.t.u.r.e.>.X.6.4.<./.A.r.c.h.i.t.e.c.t.u.r.e.>.........<.L.C.I.D.>.2.0.5.7.<./.L.C.I.D.>.......<./.O.S.V.e.r.s.i.o.n.I.n.f.o.r.m.a.t.i.o.n.>.......<.P.r.o.c.e.s.s.I.n.f.o.r.m.a.t.i.o.n.>.........<.P.i.d.>.6.5.2.0.<./.P.i.

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA42.tmp.xml

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	XML 1.0 document, ASCII text, with CRLF line terminators
Category:	dropped
Size (bytes):	4580
Entropy (8bit):	4.437259739835017
Encrypted:	false
SSDEEP:	48:cvIwWl8zs9Jg77aI99KWpW8VYZfPYm8M4JFFFoJo+q8ZFc5Zad:uIjfXI7/r7VUfSJuJoQmZad
MD5:	0798D3542D0188FF0EE8CF5FF316D579
SHA1:	6CF9277ACC33BF14CE42440B2C3E15C35D0A1DCD
SHA-256:	A81FE5C976732234CEB16FBF0498245B9928CE9F4FAC230FB3282AEDB5A54A88
SHA-512:	B5DA6177FF0CBEA1C564C40F7EA643059890D39BBFB199BF259B8CEA084062D793F53DF7E17FD669E7678909E15492342842D11365552332BD2BFC9432B3A2AD
Malicious:	false
Preview:	<?xml version="1.0" encoding="UTF-8" standalone="yes"?>..<req ver="2">.. <tlm>.. <src>.. <desc>.. <mach>.. <os>.. <arg nm="vermaj" val="10" />.. <arg nm="vermin" val="0" />.. <arg nm="verbld" val="19045" />.. <arg nm="vercsdbld" val="2006" />.. <arg nm="verqfe" val="2006" />.. <arg nm="csdbld" val="2006" />.. <arg nm="versp" val="0" />.. <arg nm="arch" val="9" />.. <arg nm="lcid" val="2057" />.. <arg nm="geoid" val="223" />.. <arg nm="sku" val="48" />.. <arg nm="domain" val="0" />.. <arg nm="prodsuite" val="256" />.. <arg nm="ntprodtype" val="1" />.. <arg nm="platid" val="2" />.. <arg nm="tmsi" val="653869" />.. <arg nm="osinsty" val="1" />.. <arg nm="iever" val="11.789.19041.0-11.0.1000" />.. <arg nm="portos" val="0" />.. <arg nm="ram" val="409

C:\ProgramData\Synaptics\RCX49C5.tmp

Download File

Process:	C:\Windows\Installer\MSI4755.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.638013190381294
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9ICXr:ansJ39LyjbJkQFMhmC+6GD9x
MD5:	ACA4D70521DE30563F4F2501D4D686A5
SHA1:	6C2BAA72EA5D08B6583893B01001E540213F4AAF
SHA-256:	449B6A3E32CEB8FC953EAF031B3E0D6EC9F2E59521570383D08DC57E5FFA3E19
SHA-512:	DA806BD4AC02C45C17ED5D050428B3E7B15E8F148ACB156CFB41EAB3E27C35FA91AB1A55D18C6EF488A82D3379ABF45421432E2EFAF2FAE4968C760D42215A7C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\RCX49C5.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\RCX49C5.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: New PO - Supplier 16-12-2024-Pdf.exe, Detection: malicious, Browse Filename: Purchase-Order.exe, Detection: malicious, Browse Filename: hoaiuy.msi, Detection: malicious, Browse Filename: 222.msi, Detection: malicious, Browse Filename: Machine-PO.exe, Detection: malicious, Browse Filename: 222.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\ProgramData\Synaptics\Synaptics.exe

Download File

Process:	C:\Windows\Installer\MSI4755.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1723904
Entropy (8bit):	7.463863136848696
Encrypted:	false
SSDEEP:	49152:gnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZlO:gnsmtk2a1hlPERBsiTs
MD5:	71386F37F17778126296CA734975DB6D
SHA1:	353818DCD74D06565FC0E8AC4416E594D29ECD0B
SHA-256:	C1317DA0FD0DC3D73B38634EA586016F6F651F52ACC576FBAE8B82721C83E9AE
SHA-512:	E5E0D87F91611BCCFEA16222C9AFB7AC7B949F1762244CED01F9D8A78E2C992CFE8C1FAAF1391F4CF107604A0E9F7A64FA4ADDA1C339D8DC85B27E7BE610B83C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Joe Sandbox View:	Filename: 222.msi, Detection: malicious, Browse Filename: 222.exe, Detection: malicious, Browse
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\Users\user\AppData\Local\Temp\2MLRDJX.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.268209015821757
Encrypted:	false
SSDEEP:	24:GgsF+0FDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+WD+pAZewRDK4mW
MD5:	73C5FFED8CAFD1FD4F9FDC11FCACE53B
SHA1:	DBA8D1B1362D3C92E416E58F221D62E2BC68FDBC
SHA-256:	D6434420B2D164D61BBAEE79467DFB5C77A1138B85CAF58A87AD9064F5114085
SHA-512:	BBAB9A2068BF37E2AFE5D34A144ACDA25DB5706495725C1BF5091E9EC796A253CFB1EDC0A6F430CB5A09BEAEBDEE6353C650E0A2D53A0BB95948FE33B62A269D
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3DEwX24GRnFcA5Rhz5zMXA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\2zOqNmd.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262844817677028
Encrypted:	false
SSDEEP:	24:GgsF+0wwSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+o+pAZewRDK4mW
MD5:	BBB0082280571362DFA811D32498B36B
SHA1:	C3D1A5E9826B77BD55D1DD6DA5844DE7599FA1F3
SHA-256:	B9D8E7BFDF337C209694E0B5D2AD6D992A9BC3AEE8DB4E6CC62303126A737E06
SHA-512:	9AFF0EFBCCFD0500F7F7AD86F354D7D8B09D124B51046CE0A8680D6D7B82253A33E0D256E18484443A9123EDBA88B19C29F7C0BE826C1599247D4A7AD18F885A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="3UX4egE8OcHvK-FpsDtZEg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\4wVxH8Y.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.261141930794047
Encrypted:	false
SSDEEP:	24:GgsF+0yDSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+1+pAZewRDK4mW
MD5:	88471E78E5BF0E7FC932ABA8411F0919
SHA1:	C3654B98186A1CED72EC8114EBD35958F669C07D
SHA-256:	DDC680217EC24AE2B85C4EFA22B8CB623A64ABFBE815CE6B4B123E284AC2E1A8
SHA-512:	B68FD75D2D50F203BC5D6B80118CD49569C3B58F5A5CCFB741B7FC9F6BFD76428E42761BD8F1968C6BB312978EDB10B510E93CC5E9F6BECE423091F74E238A56
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="R0QtUJV0-psS49v48dIPkg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\88gXYwW.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2632697366260555
Encrypted:	false
SSDEEP:	24:GgsF+0GZQSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+4+pAZewRDK4mW
MD5:	E81DEF5E8095E2B0B8205726CD75AF20
SHA1:	31B7E3E8311C98361C021D8F5C0DE76E86AE5F38
SHA-256:	A9E310AE8F0806F47620B3B28DCDD65108AAE71215D8C97C6C673352D52A7585
SHA-512:	718C313091078322BA3904473D8EF22D42F2BA729A65BCD1A32AF71FCD14B024C5EE252F688F3AE0D160D0B4D6B57F19B2D6A7930312D39907422651AA355AB5
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="BysKAMdPjEwM0qZaR_dmiw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ClL59EQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.271021134622485
Encrypted:	false
SSDEEP:	24:GgsF+0QSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j+pAZewRDK4mW
MD5:	46BF97755F9BFF97DD2073D512E52340
SHA1:	4B74D49E99BFFC8D6838FA15596E847085F11903
SHA-256:	2B9BF9F9DA32EFFF9C8751AEA98114BF2FC5CE4A85413EF7CD6D96CEB7AC462D
SHA-512:	B7BDFB446AA386608D7D37779EE0466BE2ECFB6DF560CADFB5F7ED8F279D2E42FE12E2C9608E588B69DF9A256097130505EE4DA8AB7ADF061CE8C1386C8D3639
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="hxv1FPtvPOYX-5TD0DIuSA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\CslPv46.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267347345220141
Encrypted:	false
SSDEEP:	24:GgsF+0iSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+5+pAZewRDK4mW
MD5:	8E247D5DC0230B3F16D9587160BE7006
SHA1:	928E8D8BA374C51E1AD66DF847B69464CB86B888
SHA-256:	354926CDE6B7CDFA5305BA5B653D43A9E7FE2E761C653098CBFC833EBDF30ADD
SHA-512:	4981BDDBADD295CF50F748CA04A59DC4E5090D386DB6A13917E9AB52FF4B27184627A1EA784A560009EE8F99B36228B97692B0AA0760BBF612A9E14AF82FA98E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="UsLykDQ0wr2T4W59LJFLUA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\Diiyzzi.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.253105991709949
Encrypted:	false
SSDEEP:	24:GgsF+09SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6+pAZewRDK4mW
MD5:	0F41FC80C491B39EC40D92DB82A66364
SHA1:	25499BD042F12F4400BC4AC26DBE368D4B102BB5
SHA-256:	735BAB6197E6B98C1B897DC4377D81EC430AF7E5BCAC61839AB02C2A313E912A
SHA-512:	FF886F5E78C10D278F15B4207668F1328CA6D66EF17D81BD7E6CF3693EE7EA6046B2BDB2F12738F297F518CAAFF9D5310D49C9BC5C35CFDE5E07E91F9A695591
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="D4LSrgymgxxpIFuqj5m1rQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\DsxORug.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.276411409090153
Encrypted:	false
SSDEEP:	24:GgsF+0ObSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+vb+pAZewRDK4mW
MD5:	C0481878DB827C456881F4CADBBE08CD
SHA1:	13D42E1FA0BC258CAD9474C17F43AFD5B27ED853
SHA-256:	545BAD03D3F6B7CA655BE3EA8092BAABC8A919F287F667CB287B7CDECB14951C
SHA-512:	D2475CABD7515596A06C1A993BA984E0B11BDF601DC5B7906D029D7D8C8C691E6D808EE62DD56F1A23BEAC59B6603BC6DE10E9E494B0AA7482638884FB9D3C74
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="X_EkeVCLSUQ6UFxx-DZEgA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\EbdP5pVY.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\AppData\Local\Temp\FdK1flZ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.267658529415085
Encrypted:	false
SSDEEP:	24:GgsF+0CSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+R+pAZewRDK4mW
MD5:	0567AFB0CBD3DFEC9BF3AD4F86F38540
SHA1:	1FCC55C7430FC317BEAA4E9C862178D7D040C754
SHA-256:	A8EA8B1EC97B9EDA4DC1DAD01CDA383C3E52A8C49086044B29D59A1056292315
SHA-512:	F001AFDD256E60CA0746726498B9D59CE26668AE0A8D6818F2D35F2B115DC69D3D91FC5CAE6F1077700F8B55D190C7337260CA5CF1EE2B78308EE26ABF44CC4E
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="X5F-bW8nYs9O3LNeN9iXUA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\JQWlNPQ.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.2774866955088005
Encrypted:	false
SSDEEP:	24:GgsF+05SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+e+pAZewRDK4mW
MD5:	8F009E1105568DD38A261BDF53B4357D
SHA1:	BF2690F2BBC3894EED7576B4734A3FF7AA323290
SHA-256:	F7E72E77AA8D222D9E2687791C904EE5942F2B7D19A4010258396B12934D0C43
SHA-512:	CFFC15528FB24A449A3BD6BA5D455C652A2874DB5F3F348F21B53BE091523736A5B5AA9454A3ED9CE6B0A1B805B99A61D88954EF815990BDE2905AED8E283DBD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="jHYPpUPn8Fv0mTVBvPOUzA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\TEDlv6N.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.276423674738625
Encrypted:	false
SSDEEP:	24:GgsF+0LOSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+WO+pAZewRDK4mW
MD5:	D557463B396A8D1C1FC4DCFAD8671C38
SHA1:	F5BEA6290170F062D0E1CC8C45CDCACD17922729
SHA-256:	7C3619AC0916AB542EF3C024BAFB804E33EAE52293E34A2BE22B2B029054F365
SHA-512:	1AF9F4D6CF8BB427ED766A0BA5304743C3243C1641BD724BF0BAF2BF11075DB6661E46FCF594B8613F34E6F45BDF7ABFC366158AA2D07558E7F3D598A5AB3B16
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="MvYQcDoq6FougXH6AShTWA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\W4fbo57.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.252496722206854
Encrypted:	false
SSDEEP:	24:GgsF+0JkSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+ik+pAZewRDK4mW
MD5:	1B5637E7D5BD1971AE776052F76F4F1F
SHA1:	ABC38A5CBCB0D63C7060BEB9E85328ABCCCF1636
SHA-256:	9EE4389EAA93AF245508ACC4BB5C7FADD7E0506664488FF392376812158C7F71
SHA-512:	B6AB4D153D8A96AC8AFFBE263F0EDB10E831A963B05383309BF54D58DDECAE8F04390AA18ECBEACECF5AD3731EFFFE43713E38865C4562680C6EB80C76CD1B66
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0tzS3pZc_yhikAnAfdoYcQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\ax4DOn6.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.252688268176776
Encrypted:	false
SSDEEP:	24:GgsF+06RSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+V+pAZewRDK4mW
MD5:	CDF42632E6A8CAA57495F0E6B4786619
SHA1:	9DBF11D38E14419C8A0B82CF07A17123499142A2
SHA-256:	393E94CD4FEE67CE2D309C805D3B117D1E09E50EF4AB11FA830D5A6A4FB51F69
SHA-512:	F9FABD593438C729FDA5741A26D5B0C10379DD5A0E7A5C9618BA92EAA5D0DBAFE342E1E50A5ED255D4CFCE6D2D529C4A4D934EFE8C15C05371FA8BC57426EE00
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="wYymx8_nhRYA9a4wuAEdsA">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\dyePyLV.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.257558055678864
Encrypted:	false
SSDEEP:	24:GgsF+0nwSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+H+pAZewRDK4mW
MD5:	5374A294049863E05120A76AB49C06A9
SHA1:	D74B41283312063B5D2D21F25E61D642BFA194EA
SHA-256:	D78C5A531284DCCA005A95E41EF242550C5863F58B29E4662219ED0F12035513
SHA-512:	8D0B889D3EC510D317C8A80AE98DD1F12F1C2492D56D9FCC5E49BD7EFDC4C0EA2F3DE85A62FEFAD446E7F51F565B96CA3B78111D8F66B409EB5C01E8EA292B82
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DzdvD4yfEB6Xh7atg-jnNg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gAHcLTw.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264652220295398
Encrypted:	false
SSDEEP:	24:GgsF+02RSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+7R+pAZewRDK4mW
MD5:	6B3DDDC73F37E8ABFCD30D325807464F
SHA1:	FD676087BAF1FD03365E4DD73C2B081D8BE2541C
SHA-256:	1547A74678F027C9396D335374B70021A124D0D66984839F70B14E6CF68C25A2
SHA-512:	D180ABC6D71FA198865022BC7E3FE8E0E662370DA1F55809A41F73E85A7A0050F305D6D27FECDF0B911D84DE4BB106DBE51A04A4B0EFACFC10D2D18AD1D0BAC9
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="K6G_IccnTIv1GNuOKFdA-w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\gRISx6a.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.251693729590694
Encrypted:	false
SSDEEP:	24:GgsF+0NASU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+MA+pAZewRDK4mW
MD5:	EAAEA06B432AB0A9A8CB58C9B74D8C9C
SHA1:	94C1BD3D1A544EAA4D2710BC76F9A5A17474D0E9
SHA-256:	AB36F0C752FBA4C0D200C8DBFFFA5CA62F219C1A46CAF859051AC898B9426BC0
SHA-512:	B27F3D30FDC77D7E4A674CFA60233660563D43E5DD1DA38D4F6E8804FF142C2CE0C162EB41B8FEDB1ACA5C1E7CAD7F381BB9F65E502E6859BE2C2E6171F8C1E7
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="ObZamka275bI2TOYdnX7iw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\hC2TpUN.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.264317956140634
Encrypted:	false
SSDEEP:	24:GgsF+0DSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+U+pAZewRDK4mW
MD5:	880DBA45655538567694DC1714ECE82E
SHA1:	B893FB4AEAAA23833FD6B5EFD459C78E39EA7673
SHA-256:	75BF6294DAD91F6B51502871A864ED2AEEA2325FF3519A79A9FD5D0594A25104
SHA-512:	DA7F09020F5A52EC7FE54C0187726E9D90A1944756B60967DB0E3849CE7FAB362309730A790673FE21CB0BE292AA5085E9EEF1D6313C832C9B27966560C5E6D0
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="II53zE9vxLgm9ykPmCrxZQ">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\hxVxdfA.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.256654975068276
Encrypted:	false
SSDEEP:	24:GgsF+04SU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+j+pAZewRDK4mW
MD5:	5977401506A9A15C86FCB4CE4C9EF11E
SHA1:	DC6C62442F605C4304FA9FE598C2ED25B32A4642
SHA-256:	E500931E9A6CD8B30640B02712DA92E08699FA9C912F61D4770BA38D24CA3E10
SHA-512:	875CE52152DCE307FBB0698B90E35443EC2721A0B449FDABF12C13733E01F03E0047F8BEFC371DB81277AD4F095C32ABDDB770C410227EA6B631E186553D417F
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="k0oUwwdQBr8WNfZ06WrdXg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\qBzL4Wx.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258764425859648
Encrypted:	false
SSDEEP:	24:GgsF+0OSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+B+pAZewRDK4mW
MD5:	7DF228EFE0C1CC29ED5503B0375FE652
SHA1:	F745AC32F76C87C489AD06B9652840423ABF852F
SHA-256:	D64695B500EE3B4385778AFE42F9204304953C584F161A44F976BC17DC54CBBC
SHA-512:	83DEFA7048B95D528713D945ED1831A0C523438F19E899145892A35D786117D3D17A2C9AE87C216C730C9355A13455DD9E1024DF976A59C88B475BDC5B4B3041
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="PWblfiEaXUmnJ-YbSm361w">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\quS24BB.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.246082838031933
Encrypted:	false
SSDEEP:	24:GgsF+0ujSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+D+pAZewRDK4mW
MD5:	97A3CDA81F089FFE7693DBEC8453C76C
SHA1:	5F8C6BC7AD2949269B5A4F942C6FB06D70F8B0E0
SHA-256:	537EF8D4DC783D38C1CFA5B8AE8931387E7127AD13D6BEF6EA84E239451CCBBA
SHA-512:	A0AE89A2375B182811E6709D9791D426EEFB6D47361A3D4AC274373D7616F35F60F585A3D93940E385968559763D3D2590CE19AFB46DE476D5E9689E4A98DCCD
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="sMco93jgr-P7l4ob28_mNw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\rWGgT7f.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.258110873964843
Encrypted:	false
SSDEEP:	24:GgsF+0RcSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+ic+pAZewRDK4mW
MD5:	9A3F3736F2DE8C304B18831D29655150
SHA1:	3BF34AA87E11953AC5921D0B7959132DF03080E1
SHA-256:	76F62D02E8560A7EEC7078756E702D8C061441AF6D074290F1068ECD5ADC797E
SHA-512:	475D884D98A620AA26DEE5F595CBF54A7E08E1ADF9BB2CCB780FAADB12DF8E372F98FAC77FFD2BE1EF9B1F200C108D8EC1DFA19559402EB0971C2FC5836893C1
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="M5nNpMbAbIg4QKfRxDtoMg">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\uVJsIeF.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.265182170389645
Encrypted:	false
SSDEEP:	24:GgsF+00JSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+TJ+pAZewRDK4mW
MD5:	EA772AEC362B26D0165E5E8430053E6B
SHA1:	C6546B8DAD80DEE210CE2AAAF8C075AA4FDD54C5
SHA-256:	60D4B41D9C0AD3B282CDC3561370D09BE1BF3764FB6043452482511B450B5729
SHA-512:	26FAF6C7ED19FFE15177C6028CA567AAFFA244932D8B304D34C77A25AA9DCB8A052001781222CF9E00AB9139E0F7BF5AD4BA1F764AEE00F6A33227D7144F8770
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="M8vx5X6FGAdvNfgZGfgzGw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\wcYr3lU.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.263335336053193
Encrypted:	false
SSDEEP:	24:GgsF+0BqSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+Mq+pAZewRDK4mW
MD5:	679664F809824864D3D27C60EFB8CB67
SHA1:	8520A786ED9133700DAD0111334E8613F14E7C6D
SHA-256:	BE9233924BA5F8A0089CFC7457FDB62FB4C291B5CAD0C63E270AF97B1FFE2FBC
SHA-512:	38B1CBE2B454255688E74079039EC4943C2A73F997F4884B86BD56AAD4572452191E74CA1F92539B0C5C1A78780F0538C4EB4C8F00072FCA9FE1F91D491FE421
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="pbQuFvqN3mjjbYjIGc1gYw">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\xWSJbGO.ini

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	HTML document, Unicode text, UTF-8 text, with very long lines (1648), with no line terminators
Category:	dropped
Size (bytes):	1652
Entropy (8bit):	5.262263502263181
Encrypted:	false
SSDEEP:	24:GgsF+0ZSU6pepPQfkZbc6cn1BZdAe1nCr1LTHm6D9viLRIxv+5A:GgK+6+pAZewRDK4mW
MD5:	3C07667021DA72939338E8229D800D8E
SHA1:	ECE789408909095F7D1D7C0133BF372D6DBC2AE5
SHA-256:	171C53A7067A3B382AAADCBC2A561934D5A8CB3EF314164936E8FBE2DB4323FE
SHA-512:	C675C902D0C7152AFE8FE7038734C083EAB23FB940311D04CE0F11B75F0B1CA4E0362AEF7301B9B4F5C2262A93B5795A6E6F138C2B099CC3A0C61D18F7ADB59A
Malicious:	false
Preview:	<html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="DWbVWWaez3VSh5ul_YRQog">{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding:30px 0 15px;} > body{background:url(//www.google.com/images/errors/robot.png) 100% 5px no-repeat;padding-right:205px}p{margin:11px 0 22px;overflow:hidden}pre{white-space:pre-wrap;}ins{color:#777;text-decoration:none}a img{border:0}@media screen and (max-width:772px){body{background:none;margin-top:0;max-width:none;padding-right:0}}#logo{background:url(//www.google.com/images/branding/googlelogo/1x/googlelogo_color_150x54dp.png) no-repeat;margin-left:-5px}@media only screen and (min-resolution:192dpi){#logo{background:url(//www.google.com/images/branding/googlelogo/2x/googlelogo_color_150x5

C:\Users\user\AppData\Local\Temp\~$EbdP5pVY.xlsm

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:sYp5lFltt:sYp5Nv
MD5:	B77267835A6BEAC785C351BDE8E1A61C
SHA1:	FABD93A92989535D43233E3DB9C6579D8174740E
SHA-256:	3B222E766EADC8BC9A8A90AC32FA591F313545B7E8C5D481D378AE307FA798C3
SHA-512:	FFFCBA958E9BD56F284DA19592F124C48B013FCDA2FBE65B3EB38BB644C2B0C978E6DAE99EF213B054813C7212E119B09236A6FFF342D32E52C84DD26DE1E033
Malicious:	false
Preview:	.user ..a.l.f.o.n.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\AppData\Local\Temp\~DF57498D4B66401090.TMP

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	3.746897789531007
Encrypted:	false
SSDEEP:	192:QuY+pHkfpPr76TWiu0FPZK3rcd5kM7f+ihdCF3EiRcx+NSt0ckBCecUSaFUH:ZZpEhSTWi/ekfzaVNg0c4gU
MD5:	7426F318A20A187D88A6EC88BBB53BAF
SHA1:	4F2C80834F4B5C9FCF6F4B1D4BF82C9F7CCB92CA
SHA-256:	9AF85C0291203D0F536AA3F4CB7D5FBD4554B331BF4254A6ECD99FE419217830
SHA-512:	EC7BAA93D8E3ACC738883BAA5AEDF22137C26330179164C8FCE7D7F578C552119F58573D941B7BEFC4E6848C0ADEEF358B929A733867923EE31CD2717BE20B80
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Users\user\Documents\EEGWXUHVUG\NVWZAPQSQL.xlsm

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	Microsoft Excel 2007+
Category:	dropped
Size (bytes):	18387
Entropy (8bit):	7.523057953697544
Encrypted:	false
SSDEEP:	384:oUaZLPzMfVSa1VvYXmrsdPkLmDAx7r/l0:oUatwNSSvY2IdsHr/y
MD5:	E566FC53051035E1E6FD0ED1823DE0F9
SHA1:	00BC96C48B98676ECD67E81A6F1D7754E4156044
SHA-256:	8E574B4AE6502230C0829E2319A6C146AEBD51B7008BF5BBFB731424D7952C15
SHA-512:	A12F56FF30EA35381C2B8F8AF2446CF1DAA21EE872E98CAD4B863DB060ACD4C33C5760918C277DADB7A490CB4CA2F925D59C70DC5171E16601A11BC4A6542B04
Malicious:	false
Preview:	PK..........!...5Qr...?.......[Content_Types].xml ...(......................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................N.0.E.H.C.-..@.5.....(..8...-.[.g.......M^..s.5.4.I..P;..!....r....}._.G.`....Y....M.7....&.m1cU..I.T.....`.t...^.Bx..r..~0x....6...`....reb2m.s.$.%...-c.{...dT.m.kL]Yj.\|..Yp..".G.......r...).#b.=.QN'...i..w.s..$3..)).....2wn..ls.F..X.D^K.......Cj.sx..E..n._ ....pjUS.9.....j..L...>".....w.... ....l{.sd...G.....wC.F... D..1<..=...z.As.]...#l..........PK..........!..U0#....L......._rels/.rels ...(...............

C:\Users\user\Documents\EEGWXUHVUG\~$NVWZAPQSQL.xlsx

Download File

Process:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
File Type:	data
Category:	dropped
Size (bytes):	165
Entropy (8bit):	1.5231029153786204
Encrypted:	false
SSDEEP:	3:sYp5lFltt:sYp5Nv
MD5:	B77267835A6BEAC785C351BDE8E1A61C
SHA1:	FABD93A92989535D43233E3DB9C6579D8174740E
SHA-256:	3B222E766EADC8BC9A8A90AC32FA591F313545B7E8C5D481D378AE307FA798C3
SHA-512:	FFFCBA958E9BD56F284DA19592F124C48B013FCDA2FBE65B3EB38BB644C2B0C978E6DAE99EF213B054813C7212E119B09236A6FFF342D32E52C84DD26DE1E033
Malicious:	false
Preview:	.user ..a.l.f.o.n.s. . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . . .

C:\Users\user\Documents\EEGWXUHVUG\~$cache1

Download File

Process:	C:\ProgramData\Synaptics\Synaptics.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	771584
Entropy (8bit):	6.638013190381294
Encrypted:	false
SSDEEP:	12288:aMSApJVYG5lDLyjsb0eOzkv4R7QnvUUilQ35+6G75V9ICXr:ansJ39LyjbJkQFMhmC+6GD9x
MD5:	ACA4D70521DE30563F4F2501D4D686A5
SHA1:	6C2BAA72EA5D08B6583893B01001E540213F4AAF
SHA-256:	449B6A3E32CEB8FC953EAF031B3E0D6EC9F2E59521570383D08DC57E5FFA3E19
SHA-512:	DA806BD4AC02C45C17ED5D050428B3E7B15E8F148ACB156CFB41EAB3E27C35FA91AB1A55D18C6EF488A82D3379ABF45421432E2EFAF2FAE4968C760D42215A7C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Users\user\Documents\EEGWXUHVUG\~$cache1, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Users\user\Documents\EEGWXUHVUG\~$cache1, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B.....................&....................@.......................... ...................@..............................B...........................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...............................@..P....................................@..P........................................................................................................................................

C:\Windows\Installer\674551.msi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
Category:	dropped
Size (bytes):	1748992
Entropy (8bit):	7.422118768157554
Encrypted:	false
SSDEEP:	49152:PElnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZl:Gnsmtk2a1hlPERBsiT
MD5:	53614B87538306B4F7437DB8BE2A0E47
SHA1:	A6A777B24BB64067738386CAA66787B8ED225726
SHA-256:	E86D059BD44BC6E4252972320CB811497EA87F3B0EF10EED5EDFCD7ACF44A3D8
SHA-512:	CFED71C6B9EB55B3EBFB53CBDB1611E8921A6DBE7B7EFC5456CEBB9BFB3D6A64F23A97C63415D61C38C4E3B540A79FD50CB2A080220BF3EA32EDC98F85E6ECC1
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Windows\Installer\674551.msi, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Windows\Installer\674551.msi, Author: Joe Security
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\MSI4699.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	1724626
Entropy (8bit):	7.463577046908261
Encrypted:	false
SSDEEP:	49152:HnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZl9:Hnsmtk2a1hlPERBsiTT
MD5:	B4BDB060CDA345A08B60F84B482C3AF0
SHA1:	5E7473901E4D47A9E1F69194D66D4D023E207E1D
SHA-256:	7D19D7E8D35CF4F3A30C04F1E9C2D5DFCBB115EC4C167128679B9CE941091AE3
SHA-512:	9B681CC41BEECC8F97D992E1F205026641C0EACEC75980D11C728991E179C7A1B705CCAC228857282AB1D9662D4E70C724EBAA98E08AF7535D39442DAF293E09
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Windows\Installer\MSI4699.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Windows\Installer\MSI4699.tmp, Author: Joe Security
Preview:	...@IXOS.@.....@.-.Y.@.....@.....@.....@.....@.....@......&.{29EF7317-DCA1-4159-97B2-C883AD400AC6}..Exe to msi converter free..valyzt.msi.@.....@.....@.....@........&.{C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}.....@.....@.....@.....@.......@.....@.....@.......@......Exe to msi converter free......Rollback..Rolling back action:..[1]..RollbackCleanup..Removing backup files..File: [1]...@.......@........ProcessComponents..Updating component registration.....@.....@.....@.]....&.{4C231858-2B39-11D3-8E0D-00C04F6837D0}...@.......@.....@.....@........RemoveODBC..Removing ODBC components..T....@....T....@......%._B3D13F97_1369_417D_A477_B4C42B829328....J.%._B3D13F97_1369_417D_A477_B4C42B829328.@.......N..MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B*..............................

C:\Windows\Installer\MSI4755.tmp

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows
Category:	dropped
Size (bytes):	1723904
Entropy (8bit):	7.463863136848696
Encrypted:	false
SSDEEP:	49152:gnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZlO:gnsmtk2a1hlPERBsiTs
MD5:	71386F37F17778126296CA734975DB6D
SHA1:	353818DCD74D06565FC0E8AC4416E594D29ECD0B
SHA-256:	C1317DA0FD0DC3D73B38634EA586016F6F651F52ACC576FBAE8B82721C83E9AE
SHA-512:	E5E0D87F91611BCCFEA16222C9AFB7AC7B949F1762244CED01F9D8A78E2C992CFE8C1FAAF1391F4CF107604A0E9F7A64FA4ADDA1C339D8DC85B27E7BE610B83C
Malicious:	true
Yara Hits:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Windows\Installer\MSI4755.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Windows\Installer\MSI4755.tmp, Author: Joe Security
Antivirus:	Antivirus: Avira, Detection: 100% Antivirus: Avira, Detection: 100% Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 92%
Preview:	MZP.....................@...............................................!..L.!..This program must be run under Win32..$7........................................................................................................................................PE..L....^B..........................................@..............................................@..............................B......0....................P...............@..!............@......................................................CODE............................... ..`DATA....T........0..................@...BSS......................................idata..B*.......,..................@....tls.........0...........................rdata..9....@......................@..P.reloc.......P......................@..P.rsrc...0...........................@..P....................................@..P........................................................................................................................................

C:\Windows\Installer\SourceHash{29EF7317-DCA1-4159-97B2-C883AD400AC6}

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.16265166967116
Encrypted:	false
SSDEEP:	12:JSbX72FjiAGiLIlHVRpth/7777777777777777777777777vDHFwL2JpSl0i8Q:JIQI5pmAF
MD5:	04C773E74E0A3920F8C08920036ABAD8
SHA1:	2C81A7125D1FA3633622177E093064DD7B8FD15E
SHA-256:	394D8B9166C47E3D03EEA13F94989C02D9DB8B12FFC307E8F81907729C7EA85E
SHA-512:	6A0F33E676D88359C3B84F6BDD7545676A7E465402782CC9EBE77A4F110AB52FB57C6B453F73A40AC080CE508D2EDB820CAFEFF7FE45E72DA19B617F84D9923A
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Installer\inprogressinstallinfo.ipi

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4184193448562894
Encrypted:	false
SSDEEP:	48:XR8PhkuRc06WXJejT54rvAaSzUpcSzfT:chk11jTmrvAaYZY
MD5:	017E75EA112E4BE5E18B8381D09C75C9
SHA1:	5F122F132B5FB049F079268A4DB16EA73A7A3CFE
SHA-256:	4F78D6EA7FF3284C54D0CA79A2DABBE2B04B5052F8806698D2969F564BA5AFE0
SHA-512:	6981E5EE7FCA9F2B415A1F45818AC219312FA324CB9CFCDE2CADDD16237CC070C7B1FC91940A831E1010324808591E3D01724ABEC661B33BCA4D75FACFA749BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.log

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
Category:	dropped
Size (bytes):	364484
Entropy (8bit):	5.365490317437716
Encrypted:	false
SSDEEP:	1536:6qELG7gK+RaOOp3LCCpfmLgYI66xgFF9Sq8K6MAS2OMUHl6Gin327D22A26KgauZ:zTtbmkExhMJCIpEO
MD5:	BABD5D7DD69EF3773E5A13C6AE48C5A1
SHA1:	07BE2C855EE09907D42F0DA48CFFCBF0BF7EFCA6
SHA-256:	88CC72FDCAAF6FC382305B3E996A68A3FEE6502DDC5B07B912481A6A7E069483
SHA-512:	52FEEDD0C8CF55C6510B20AF8DAF78EABB790CB2CE45234CAB795B12B7EBEA7DE77FFB8CF71B15507AA6884F8550AC3A6CE1EABD8740A308DD499068AA2C6B88
Malicious:	false
Preview:	.To learn about increasing the verbosity of the NGen log files please see http://go.microsoft.com/fwlink/?linkid=210113..12/07/2019 14:54:22.458 [5488]: Command line: D:\wd\compilerTemp\BMT.200yuild.1bk\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe executeQueuedItems /nologo ..12/07/2019 14:54:22.473 [5488]: Executing command from offline queue: install "System.Runtime.WindowsRuntime.UI.Xaml, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=b77a5c561934e089, processorArchitecture=msil" /NoDependencies /queue:1..12/07/2019 14:54:22.490 [5488]: Executing command from offline queue: install "System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil" /NoDependencies /queue:3..12/07/2019 14:54:22.490 [5488]: Exclusion list entry found for System.Web.ApplicationServices, Version=4.0.0.0, Culture=Neutral, PublicKeyToken=31bf3856ad364e35, processorArchitecture=msil; it will not be installed..12/07/2019 14:54:22.490 [

C:\Windows\SysWOW64\._cache_MSI4755.tmp

Download File

Process:	C:\Windows\Installer\MSI4755.tmp
File Type:	PE32 executable (GUI) Intel 80386, for MS Windows, UPX compressed
Category:	dropped
Size (bytes):	952320
Entropy (8bit):	7.853882881449956
Encrypted:	false
SSDEEP:	24576:ZhloDX0XOf4LvPAXY3+3NRMaqIL90KNUFmX1tqqNZlz:ZhloJfCAh9RMUBrNUFqtBZl
MD5:	36F4C5372C6391F782C2DB490081746F
SHA1:	A0B1EC84B0A2DB8F801981E247578217B71B38DA
SHA-256:	1FE023F69F42FCD4BE4BAA180BBFF00B7FFE51C553211DD0DF45FB7FF71148B8
SHA-512:	111C1915D81141398B6BB7A0AA0E98896FB05D5548ACE8FD1E0E23343EAE60EA1E3D6617D3F5F883B96C8E05F5F868A280683341810896C00FA6EF1F68338992
Malicious:	true
Antivirus:	Antivirus: Joe Sandbox ML, Detection: 100% Antivirus: ReversingLabs, Detection: 55%
Preview:	MZ......................@...............................................!..L.!This program cannot be run in DOS mode....$.......S.............g.........$.............%....H......X.2........q)..Z..q).....q).......\....q).....Rich...........................PE..L....Hng.........."......P...@...`.......p........@........................... ...........@...@.......@.....................\...$.......\;..............................................................H...........................................UPX0.....`..............................UPX1.....P...p...D..................@....rsrc....@.......@...H..............@..............................................................................................................................................................................................................................................................................................................................................................3.07.UPX!....

C:\Windows\Temp\~DF023A6383FEDEE607.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1472890586714402
Encrypted:	false
SSDEEP:	24:JYYh+3AmMuxliEipKP2xza2tzhAzZZagUMClXtdd+idrv+4QaipVJ+ZVQwGmrkfy:mnLMuHJveFXJ5T5HrvAaSzUpcSzfT
MD5:	CA5663A6359E746C09FE3F8EFD2D33CF
SHA1:	1DDA0C2193301BC351FE45054D8EE008F24209BE
SHA-256:	F75723E126C41080DE93B129309F5E45E20F8AED253C1414176B673D1198304F
SHA-512:	E75AFBF59A2E5B3677241BA0CEAFFEA219251999C3B64A26B988BAC4F56CFC54196FCF068D04C4C7B0FD95A3998ECC01E49F43DC938CC04578A39ADB4FE43DE8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF044B9400AF3F8FCD.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	69632
Entropy (8bit):	0.08583513603533954
Encrypted:	false
SSDEEP:	12:5wW2syASClZvb+ipVJ+8lqipVJ+soVjfFJIiWlIC1nI2tpqsA5GnQbEo+kDWG2F1:ZPDvb+ipVJ+dipVJ+ZVQwGmrksJ+4br
MD5:	A3363BA1DC3002696ACCB1607ECEE57B
SHA1:	DFB1E95D17055701EEB55B50A37A0008F286D9E5
SHA-256:	C65BD0816F4A6AF926F870BC90D498A4B5EF9094610C65465D2BD6D8B97365CC
SHA-512:	FBED5B6C69ACC989724E1795BEEA94406B21A662F7470CAF0A031D4317A5623C33C89A5F44AB26E9C544649F3DBE8074F1D8CAF6F6B017AAAC5ED6B3FCD2EFC6
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF16A695E94999B39C.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	0.06943164993294329
Encrypted:	false
SSDEEP:	6:2/9LG7iVCnLG7iVrKOzPLHKOohjH1cs9mstQVky6lS:2F0i8n0itFzDHFwLVJS
MD5:	A82618852BEC8B2073A5B7BF7CA5D21F
SHA1:	16480A133FCD4D899E950BEDF182EEEAC82DB9FD
SHA-256:	8220F65A6F0E1FBA9941FB6465345114C0A519D66DFC10291FACB823B4689DE8
SHA-512:	9C5F68D1FA02ED3588D907A3B10D953707F1FDF78DEAC39D39389959388C8E0795CCADF45D4B990FB48200AB64A32A16E34E87EFCAC71C0E8084CDB040DB99B9
Malicious:	false
Preview:	........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF371462A54609FB75.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF411EE95866A4A238.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DF9A0BE16119A694E6.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1472890586714402
Encrypted:	false
SSDEEP:	24:JYYh+3AmMuxliEipKP2xza2tzhAzZZagUMClXtdd+idrv+4QaipVJ+ZVQwGmrkfy:mnLMuHJveFXJ5T5HrvAaSzUpcSzfT
MD5:	CA5663A6359E746C09FE3F8EFD2D33CF
SHA1:	1DDA0C2193301BC351FE45054D8EE008F24209BE
SHA-256:	F75723E126C41080DE93B129309F5E45E20F8AED253C1414176B673D1198304F
SHA-512:	E75AFBF59A2E5B3677241BA0CEAFFEA219251999C3B64A26B988BAC4F56CFC54196FCF068D04C4C7B0FD95A3998ECC01E49F43DC938CC04578A39ADB4FE43DE8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFA6734F6B7D6EFD48.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	32768
Entropy (8bit):	1.1472890586714402
Encrypted:	false
SSDEEP:	24:JYYh+3AmMuxliEipKP2xza2tzhAzZZagUMClXtdd+idrv+4QaipVJ+ZVQwGmrkfy:mnLMuHJveFXJ5T5HrvAaSzUpcSzfT
MD5:	CA5663A6359E746C09FE3F8EFD2D33CF
SHA1:	1DDA0C2193301BC351FE45054D8EE008F24209BE
SHA-256:	F75723E126C41080DE93B129309F5E45E20F8AED253C1414176B673D1198304F
SHA-512:	E75AFBF59A2E5B3677241BA0CEAFFEA219251999C3B64A26B988BAC4F56CFC54196FCF068D04C4C7B0FD95A3998ECC01E49F43DC938CC04578A39ADB4FE43DE8
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFBAEAAC2FD382F144.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFD0AE7AD84815C4FA.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4184193448562894
Encrypted:	false
SSDEEP:	48:XR8PhkuRc06WXJejT54rvAaSzUpcSzfT:chk11jTmrvAaYZY
MD5:	017E75EA112E4BE5E18B8381D09C75C9
SHA1:	5F122F132B5FB049F079268A4DB16EA73A7A3CFE
SHA-256:	4F78D6EA7FF3284C54D0CA79A2DABBE2B04B5052F8806698D2969F564BA5AFE0
SHA-512:	6981E5EE7FCA9F2B415A1F45818AC219312FA324CB9CFCDE2CADDD16237CC070C7B1FC91940A831E1010324808591E3D01724ABEC661B33BCA4D75FACFA749BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFDF696DE088BBF766.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFEE3CA34BA899E362.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	data
Category:	dropped
Size (bytes):	512
Entropy (8bit):	0.0
Encrypted:	false
SSDEEP:	3::
MD5:	BF619EAC0CDF3F68D496EA9344137E8B
SHA1:	5C3EB80066420002BC3DCC7CA4AB6EFAD7ED4AE5
SHA-256:	076A27C79E5ACE2A3D47F9DD2E83E4FF6EA8872B3C2218F66C92B89B55F36560
SHA-512:	DF40D4A774E0B453A5B87C00D6F0EF5D753143454E88EE5F7B607134598294C7905CCBCF94BBC46E474DB6EB44E56A6DBB6D9A1BE9D4FB5D1B5F2D0C6ED34BFE
Malicious:	false
Preview:	................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\Temp\~DFF1324BFDDCFC1678.TMP

Download File

Process:	C:\Windows\System32\msiexec.exe
File Type:	Composite Document File V2 Document, Cannot read section info
Category:	dropped
Size (bytes):	20480
Entropy (8bit):	1.4184193448562894
Encrypted:	false
SSDEEP:	48:XR8PhkuRc06WXJejT54rvAaSzUpcSzfT:chk11jTmrvAaYZY
MD5:	017E75EA112E4BE5E18B8381D09C75C9
SHA1:	5F122F132B5FB049F079268A4DB16EA73A7A3CFE
SHA-256:	4F78D6EA7FF3284C54D0CA79A2DABBE2B04B5052F8806698D2969F564BA5AFE0
SHA-512:	6981E5EE7FCA9F2B415A1F45818AC219312FA324CB9CFCDE2CADDD16237CC070C7B1FC91940A831E1010324808591E3D01724ABEC661B33BCA4D75FACFA749BD
Malicious:	false
Preview:	......................>...............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

C:\Windows\appcompat\Programs\Amcache.hve

Download File

Process:	C:\Windows\SysWOW64\WerFault.exe
File Type:	MS Windows registry file, NT/2000 or above
Category:	dropped
Size (bytes):	1835008
Entropy (8bit):	4.421750023047357
Encrypted:	false
SSDEEP:	6144:mSvfpi6ceLP/9skLmb0OTMWSPHaJG8nAgeMZMMhA2fX4WABlEnNT0uhiTw:FvloTMW+EZMM6DFyp03w
MD5:	88F21DD854E3B4D6DFCE6C5AE3CFC7EE
SHA1:	3BA39114D8A150A831E175C17D379C7CDD230C51
SHA-256:	73F2335B9FA3A334FC390783ED8411CFFDB4EB51CDE7EABEA20438C90D39BF84
SHA-512:	674144B600E9386E6C66A3C8E5812DDA2A88B157EDF699B0233F2EF7D34C2048847935F9BE6E660CB0D8CFC9BDA2EE436A8FBCA0FDB7B263699CD0A4335D1F18
Malicious:	false
Preview:	regf>...>....\.Z.................... ...........\.A.p.p.C.o.m.p.a.t.\.P.r.o.g.r.a.m.s.\.A.m.c.a.c.h.e...h.v.e....c...b...#.......c...b...#...........c...b...#......rmtmNU...Z..............................................................................................................................................................................................................................................................................................................................................@.(........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

Static File Info

General

File type:	Composite Document File V2 Document, Little Endian, Os: Windows, Version 6.1, MSI Installer, Code page: 1252, Last Printed: Fri Sep 21 10:56:09 2012, Create Time/Date: Fri Sep 21 10:56:09 2012, Name of Creating Application: Windows Installer, Title: Exe to msi converter free, Author: www.exetomsi.com, Template: ;0, Last Saved By: devuser, Revision Number: {C35CF0AA-9B3F-4903-9F05-EBF606D58D3E}, Last Saved Time/Date: Tue May 21 12:56:44 2013, Number of Pages: 100, Number of Words: 0, Security: 0
Entropy (8bit):	7.422118768157554
TrID:	Generic OLE2 / Multistream Compound File (8008/1) 100.00%
File name:	valyzt.msi
File size:	1'748'992 bytes
MD5:	53614b87538306b4f7437db8be2a0e47
SHA1:	a6a777b24bb64067738386caa66787b8ed225726
SHA256:	e86d059bd44bc6e4252972320cb811497ea87f3b0ef10eed5edfcd7acf44a3d8
SHA512:	cfed71c6b9eb55b3ebfb53cbdb1611e8921a6dbe7b7efc5456cebb9bfb3d6a64f23a97c63415d61c38c4e3b540a79fd50cb2a080220bf3ea32edc98f85e6ecc1
SSDEEP:	49152:PElnsHyjtk2MYC5GD8hloJfCAh9RMUBrNUFqtBZl:Gnsmtk2a1hlPERBsiT
TLSH:	C985C0B2B3818436D433563C8C7B93A75427BE5D1D38690E3BE57E4E6E3A34228261D7
File Content Preview:	........................>......................................................................................................................................................................................................................................

File Icon


Icon Hash:	2d2e3797b32b2b99

Network Behavior

Suricata IDS Alerts

Timestamp	SID	Signature	Severity	Source IP	Source Port	Dest IP	Dest Port	Protocol
2024-12-30T11:46:22.147888+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49709	142.250.186.174	443	TCP
2024-12-30T11:46:22.170043+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49710	142.250.186.174	443	TCP
2024-12-30T11:46:22.654552+0100	2832617	ETPRO MALWARE W32.Bloat-A Checkin	1	192.168.2.5	49713	69.42.215.252	80	TCP
2024-12-30T11:46:23.123167+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49714	142.250.186.174	443	TCP
2024-12-30T11:46:23.152498+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49716	142.250.186.174	443	TCP
2024-12-30T11:46:24.118313+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49719	142.250.186.174	443	TCP
2024-12-30T11:46:24.141235+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49720	142.250.186.174	443	TCP
2024-12-30T11:46:25.100339+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49723	142.250.186.174	443	TCP
2024-12-30T11:46:25.110473+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49724	142.250.186.174	443	TCP
2024-12-30T11:46:25.870288+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49730	142.250.186.174	443	TCP
2024-12-30T11:46:25.870327+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49731	142.250.186.174	443	TCP
2024-12-30T11:46:26.923984+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49737	142.250.186.174	443	TCP
2024-12-30T11:46:26.964376+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49738	142.250.186.174	443	TCP
2024-12-30T11:46:27.933383+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49744	142.250.186.174	443	TCP
2024-12-30T11:46:27.957017+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49746	142.250.186.174	443	TCP
2024-12-30T11:46:28.912183+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49748	142.250.186.174	443	TCP
2024-12-30T11:46:28.940968+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49750	142.250.186.174	443	TCP
2024-12-30T11:46:29.885211+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49754	142.250.186.174	443	TCP
2024-12-30T11:46:29.916391+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49755	142.250.186.174	443	TCP
2024-12-30T11:46:30.927049+0100	2044887	ET MALWARE Snake Keylogger Payload Request (GET)	1	192.168.2.5	49764	142.250.186.174	443	TCP

Network Port Distribution

TCP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 11:46:21.141509056 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.141535997 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.141618967 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.149461985 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.149477005 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.167572975 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.167620897 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.167695045 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.167972088 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.167989969 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.776310921 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.776408911 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.777096033 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.777151108 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.794801950 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.794934034 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.795598030 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.795684099 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.854978085 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.855000019 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.855329990 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.855379105 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.859755993 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.861989975 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.862004995 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.862344980 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.862438917 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.863048077 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:21.903321981 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:21.903326035 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.064917088 CET	49713	80	192.168.2.5	69.42.215.252
Dec 30, 2024 11:46:22.069859982 CET	80	49713	69.42.215.252	192.168.2.5
Dec 30, 2024 11:46:22.069957972 CET	49713	80	192.168.2.5	69.42.215.252
Dec 30, 2024 11:46:22.070152998 CET	49713	80	192.168.2.5	69.42.215.252
Dec 30, 2024 11:46:22.074942112 CET	80	49713	69.42.215.252	192.168.2.5
Dec 30, 2024 11:46:22.147887945 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.147957087 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.148124933 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.148160934 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.148312092 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.148312092 CET	443	49709	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.148382902 CET	49709	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.149127007 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.149177074 CET	443	49714	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.149246931 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.149564981 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.149581909 CET	443	49714	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.160857916 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.160903931 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.160990953 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.161288023 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.161303997 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.170047998 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.170126915 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.170152903 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.170198917 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.170275927 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.170310020 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.170454979 CET	443	49710	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.170509100 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.170526028 CET	49710	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.170856953 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.170897961 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.170958042 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.171111107 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.171147108 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.171204090 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.171246052 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.171256065 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.171467066 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.171477079 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.654459953 CET	80	49713	69.42.215.252	192.168.2.5
Dec 30, 2024 11:46:22.654551983 CET	49713	80	192.168.2.5	69.42.215.252
Dec 30, 2024 11:46:22.749514103 CET	443	49714	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.749604940 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.750597000 CET	443	49714	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.750648022 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.755247116 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.755260944 CET	443	49714	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.755718946 CET	443	49714	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.755778074 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.756165981 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.777100086 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.777185917 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.778748989 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.778819084 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.779633999 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.779717922 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.781045914 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.781058073 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.781361103 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.781431913 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.781913996 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.785161972 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.785175085 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.785444975 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.785499096 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.785989046 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:22.794801950 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.794877052 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.798393965 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.798404932 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.798686981 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.798773050 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.799124956 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:22.803339005 CET	443	49714	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.827356100 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:22.827378035 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:22.843333960 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.123172998 CET	443	49714	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.123254061 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.123477936 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.123528004 CET	443	49714	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.123589993 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.123604059 CET	49714	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.124250889 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.124296904 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.124357939 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.124627113 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.124640942 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.152515888 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.152597904 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.152627945 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.152705908 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.152903080 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.152946949 CET	443	49716	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.153008938 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.153053045 CET	49716	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.154194117 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.154242992 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.154356956 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.154628992 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.154645920 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.182791948 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.182853937 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.182876110 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.182910919 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.182928085 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.182982922 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.182991028 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.183028936 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.188824892 CET	49717	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.188837051 CET	443	49717	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.189856052 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.189893007 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.190068007 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.190289021 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.190299988 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.343216896 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.343257904 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.343377113 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.343409061 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.343451977 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.343941927 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.343987942 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.344046116 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.403908968 CET	49715	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.403938055 CET	443	49715	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.406881094 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.406908035 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.407001019 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.451299906 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.451308012 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.744934082 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.745053053 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.745724916 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.745773077 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.755896091 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.756130934 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.756675959 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.756728888 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.792498112 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.792661905 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.831938982 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.831990004 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.832421064 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.832470894 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.833086014 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.852291107 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.852325916 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.852674961 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.852746964 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.854193926 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:23.855750084 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.855777979 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.856205940 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:23.856224060 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:23.879333019 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:23.899329901 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.061311007 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.061367035 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.061911106 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.061916113 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.062216997 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.062221050 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.118335962 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.118396044 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.119164944 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.119205952 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.119215965 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.119268894 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.127002001 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.127033949 CET	443	49719	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.127049923 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.127080917 CET	49719	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.127742052 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.127752066 CET	443	49723	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.127814054 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.128336906 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.128346920 CET	443	49723	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.141252041 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.141310930 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.141324997 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.141385078 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.141495943 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.141535044 CET	443	49720	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.141585112 CET	49720	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.142175913 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.142194033 CET	443	49724	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.142263889 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.142673016 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.142683983 CET	443	49724	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.197364092 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.197426081 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.197449923 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.197463036 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.197501898 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.197521925 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.197562933 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.197566986 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.197608948 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.197623968 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.197659969 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.199565887 CET	49721	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.199579954 CET	443	49721	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.200122118 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.200134039 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.200196981 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.200773954 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.200784922 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.471421957 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.471466064 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.471565962 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.471565962 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.471575022 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.471637011 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.471679926 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.471685886 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.473536968 CET	49722	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.473555088 CET	443	49722	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.474657059 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.474706888 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.474802017 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.475018024 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.475028992 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.727905035 CET	443	49723	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.727982044 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.728936911 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.728941917 CET	443	49723	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.731858969 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.731864929 CET	443	49723	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.741830111 CET	443	49724	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.741949081 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.742600918 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.742605925 CET	443	49724	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.744573116 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:24.744580030 CET	443	49724	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:24.799328089 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.799439907 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.800069094 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.800072908 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:24.802797079 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:24.802802086 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.075371027 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.075453043 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.076277971 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.076289892 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.076479912 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.076483965 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.100392103 CET	443	49723	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.100476980 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.100487947 CET	443	49723	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.100536108 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.100656033 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.100716114 CET	443	49723	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.100874901 CET	443	49723	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.100934982 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.100953102 CET	49723	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.101363897 CET	49730	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.101411104 CET	443	49730	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.101528883 CET	49730	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.101892948 CET	49730	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.101906061 CET	443	49730	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.110486984 CET	443	49724	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.110615015 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.110627890 CET	443	49724	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.110745907 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.110745907 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.110794067 CET	443	49724	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.110846996 CET	49724	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.111531019 CET	49731	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.111572027 CET	443	49731	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.111664057 CET	49731	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.111954927 CET	49731	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.111965895 CET	443	49731	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.202042103 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.202094078 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.202107906 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.202124119 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.202172995 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.202188969 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.202194929 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.202203989 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.202250004 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.205924034 CET	49725	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.205943108 CET	443	49725	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.206954002 CET	49733	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.206991911 CET	443	49733	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.207273960 CET	49733	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.207386017 CET	49733	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.207396984 CET	443	49733	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.529185057 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.529227972 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.529246092 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.529268026 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.529289007 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.529313087 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.529318094 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.529334068 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.529350996 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.529378891 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.530162096 CET	49728	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.530173063 CET	443	49728	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.531204939 CET	49735	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.531227112 CET	443	49735	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.531471968 CET	49735	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.531784058 CET	49735	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.531799078 CET	443	49735	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.702397108 CET	443	49730	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.702500105 CET	49730	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.703176975 CET	443	49730	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.703229904 CET	49730	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.707288027 CET	49730	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.707298994 CET	443	49730	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.707561970 CET	443	49730	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.707703114 CET	49730	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.708332062 CET	49730	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.711935043 CET	443	49731	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.712023020 CET	49731	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.712686062 CET	443	49731	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.712843895 CET	49731	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.714431047 CET	49731	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.714440107 CET	443	49731	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.714683056 CET	443	49731	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.714989901 CET	49731	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.715820074 CET	49731	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.751337051 CET	443	49730	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.759340048 CET	443	49731	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.825591087 CET	443	49733	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.825680971 CET	49733	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.831927061 CET	49733	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.831940889 CET	443	49733	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.832612038 CET	49733	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.832633972 CET	443	49733	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:25.869921923 CET	49735	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.869957924 CET	49730	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.869985104 CET	49731	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.870039940 CET	49733	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:25.946116924 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.946186066 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.946296930 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.947118998 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.947133064 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.948999882 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.949054003 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:25.949170113 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.949542999 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:25.949554920 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.546746969 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.546813965 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.548588037 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.551188946 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.617456913 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.617472887 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.636419058 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.636425018 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.686013937 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.686073065 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.686656952 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.686671019 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.923985958 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.924057007 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.924077988 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.924125910 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.925107956 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.925149918 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.925163984 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.925209045 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.929116011 CET	49737	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.929131031 CET	443	49737	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.930135012 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:26.930164099 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:26.930223942 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:26.930711985 CET	49744	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.930720091 CET	443	49744	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.930768013 CET	49744	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.940417051 CET	49744	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.940431118 CET	443	49744	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.941344023 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:26.941354990 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:26.964387894 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.964658976 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.964732885 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.964798927 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.966069937 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.966120958 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.966134071 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.966183901 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.980652094 CET	49738	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.980690002 CET	443	49738	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.981889963 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:26.981966019 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:26.982027054 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:26.982260942 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.982290030 CET	443	49746	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.982345104 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.982815027 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:26.982826948 CET	443	49746	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:26.986613989 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:26.986629963 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.540936947 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.541011095 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.550863981 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.550878048 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.551135063 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.551187992 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.551568031 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.560534000 CET	443	49744	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.560596943 CET	49744	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.560930014 CET	49744	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.560935974 CET	443	49744	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.562760115 CET	49744	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.562764883 CET	443	49744	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.581759930 CET	443	49746	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.581841946 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.582473993 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.582478046 CET	443	49746	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.582639933 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.582643986 CET	443	49746	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.595324993 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.603843927 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.603910923 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.605792046 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.605798006 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.606112957 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.606168032 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.606559038 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.647339106 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.933381081 CET	443	49744	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.933540106 CET	49744	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.933743954 CET	49744	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.933790922 CET	443	49744	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.933845043 CET	49744	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.934854984 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.934902906 CET	443	49748	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.934974909 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.935235023 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.935247898 CET	443	49748	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.947607994 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.947669029 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.947673082 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.947684050 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.947714090 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.947734118 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.947742939 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.947783947 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.947783947 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.947835922 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.949037075 CET	49743	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.949048042 CET	443	49743	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.949455976 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.949491024 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.949717999 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.949933052 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:27.949949980 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:27.957016945 CET	443	49746	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.957108021 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.957124949 CET	443	49746	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.957160950 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.957297087 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.957330942 CET	443	49746	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.957376003 CET	49746	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.958368063 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.958384037 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:27.958679914 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.958969116 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:27.958980083 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.097841978 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.097897053 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.097960949 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.097991943 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.098009109 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.098031044 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.098062992 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.098963022 CET	49745	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.098980904 CET	443	49745	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.099548101 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.099575996 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.099653959 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.099884987 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.099895000 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.535769939 CET	443	49748	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.535851002 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.536551952 CET	443	49748	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.536623955 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.538645029 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.538655043 CET	443	49748	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.538923025 CET	443	49748	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.539304018 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.539469004 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.545254946 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.545320034 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.545624018 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.545631886 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.545783997 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.545788050 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.566803932 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.566876888 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.567590952 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.567646980 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.569444895 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.569451094 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.569703102 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.569772959 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.570126057 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.583345890 CET	443	49748	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.611327887 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.700203896 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.700284958 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.701596975 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.701605082 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.701807022 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.701811075 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.912180901 CET	443	49748	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.912259102 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.912498951 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.912533045 CET	443	49748	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.912626982 CET	49748	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.913285971 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.913317919 CET	443	49754	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.913414001 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.913764954 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.913775921 CET	443	49754	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.940979958 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.941133022 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.941154957 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.941198111 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.941277981 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.941309929 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.941459894 CET	443	49750	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.941514015 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.941536903 CET	49750	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.942116022 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.942147970 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.942235947 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.942717075 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:28.942735910 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:28.953327894 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.953389883 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.953411102 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.953438044 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.953450918 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.953475952 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.953480959 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.953500032 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.953541040 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.954461098 CET	49749	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.954473019 CET	443	49749	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.955159903 CET	49756	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.955192089 CET	443	49756	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:28.955246925 CET	49756	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.955665112 CET	49756	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:28.955677986 CET	443	49756	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.102315903 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.102368116 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.102397919 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.102430105 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.102442026 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.102483034 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.102488041 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.102503061 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.102544069 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.102566004 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.103532076 CET	49751	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.103552103 CET	443	49751	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.104470015 CET	49758	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.104511976 CET	443	49758	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.104872942 CET	49758	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.105436087 CET	49758	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.105453014 CET	443	49758	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.513874054 CET	443	49754	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.513947964 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.514776945 CET	443	49754	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.514889002 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.524874926 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.524884939 CET	443	49754	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.525198936 CET	443	49754	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.525252104 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.525650024 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.543489933 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.543593884 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.544320107 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.544369936 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.546278000 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.546284914 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.546525002 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.548280954 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.548675060 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.554919004 CET	443	49756	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.555003881 CET	49756	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.555529118 CET	49756	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.555536985 CET	443	49756	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.557337046 CET	49756	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.557343006 CET	443	49756	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.567329884 CET	443	49754	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.595331907 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.712744951 CET	443	49758	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.712832928 CET	49758	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.713480949 CET	49758	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.713486910 CET	443	49758	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.713815928 CET	49758	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.713820934 CET	443	49758	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.885225058 CET	443	49754	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.885325909 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.885401011 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.885447979 CET	443	49754	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.885545015 CET	49754	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.886101961 CET	49763	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.886161089 CET	443	49763	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.886229038 CET	49763	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.886475086 CET	49763	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.886486053 CET	443	49763	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.916385889 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.916449070 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.916464090 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.916508913 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.917138100 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.917167902 CET	443	49755	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.917215109 CET	49755	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.917824030 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.917865992 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.918417931 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.918740988 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.918755054 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.947148085 CET	49763	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.947163105 CET	49756	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.947163105 CET	49758	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.954411983 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.954431057 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.954592943 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.955326080 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.955336094 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.955910921 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.955930948 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.956418037 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.956876040 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.956909895 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:29.957067966 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.958003998 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:29.958018064 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:29.958081961 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:29.958110094 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.526586056 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.526662111 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.527384043 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.527443886 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.529350996 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.529360056 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.529599905 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.529658079 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.529993057 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.554290056 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.554346085 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.554687977 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.554697037 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.554851055 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.554856062 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.556467056 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.556526899 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.556854010 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.556859016 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.557025909 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.557030916 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.565721989 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.565793037 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.566494942 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.566551924 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.568082094 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.568092108 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.568331957 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.568397999 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.568681002 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.571332932 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.611345053 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.927035093 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.927140951 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.927166939 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.927289963 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.927392006 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.927428007 CET	443	49764	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.927484989 CET	49764	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.928148985 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.928179026 CET	443	49769	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.928245068 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.928488970 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.928503990 CET	443	49769	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.931812048 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.931870937 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.931901932 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.931947947 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.931982040 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.932014942 CET	443	49767	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.932060003 CET	49767	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.932470083 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.932496071 CET	443	49770	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.932578087 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.932825089 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:30.932838917 CET	443	49770	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:30.985198975 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.985248089 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.985260963 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.985289097 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.985301971 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.985327959 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.985335112 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.985368967 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.985378027 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.985414028 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.985966921 CET	49765	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.985979080 CET	443	49765	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.986944914 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.986965895 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:30.987046003 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.987245083 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:30.987257957 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.136672974 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.136729002 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.136735916 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.136750937 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.136765003 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.136816978 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.136823893 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.136847019 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.136868000 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.136893988 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.137782097 CET	49766	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.137789965 CET	443	49766	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.138906956 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.138940096 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.139050007 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.139413118 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.139425039 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.531841040 CET	443	49770	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.531955004 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.532625914 CET	443	49770	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.532689095 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.536119938 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.536137104 CET	443	49770	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.536411047 CET	443	49770	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.536497116 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.536917925 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.547347069 CET	443	49769	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.547421932 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.548255920 CET	443	49769	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.548316956 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.549962997 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.549969912 CET	443	49769	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.550240040 CET	443	49769	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.550296068 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.550585032 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.579332113 CET	443	49770	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.584117889 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.584176064 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.584489107 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.584496021 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.586529016 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.586534023 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.591330051 CET	443	49769	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.757771015 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.757852077 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.758352995 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.758368015 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.758544922 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.758553982 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.911032915 CET	443	49770	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.911114931 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.911307096 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.911349058 CET	443	49770	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.911446095 CET	49770	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.911890030 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.911923885 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.912004948 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.912285089 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.912296057 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.916888952 CET	443	49769	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.916996002 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.917073011 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.917124033 CET	443	49769	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.917177916 CET	49769	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.917604923 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.917638063 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.917721033 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.917901039 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:31.917913914 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:31.982604980 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.982666969 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.982676029 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.982695103 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.982707024 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.982752085 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.982758045 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.982808113 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.982810020 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.982853889 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.983597994 CET	49771	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.983608961 CET	443	49771	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.984092951 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.984113932 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:31.984180927 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.984416962 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:31.984428883 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.170192957 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.170245886 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.170258999 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.170286894 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.170325994 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.170368910 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.170377016 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.170387983 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.170470953 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.171097994 CET	49772	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.171125889 CET	443	49772	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.171720028 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.171762943 CET	443	49779	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.171886921 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.172215939 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.172231913 CET	443	49779	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.540218115 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.540318966 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.541028023 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.541081905 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.543237925 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.543242931 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.543478966 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.543534994 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.543904066 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.584166050 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.584233046 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.584656000 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.584662914 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.584841967 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.584846973 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.591329098 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.611341953 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.611428022 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.612118959 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.612194061 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.614006996 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.614012003 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.614237070 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.614295006 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.614694118 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.655343056 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.803695917 CET	443	49779	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.803774118 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.804380894 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.804389954 CET	443	49779	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.804666996 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.804672003 CET	443	49779	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.914081097 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.914141893 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.914155006 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.914200068 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.914381981 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.914402962 CET	443	49776	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.914458990 CET	49776	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.915050983 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.915086985 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.915162086 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.915409088 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.915419102 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.988848925 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.989089012 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.989099026 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.989268064 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.989351034 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.989383936 CET	443	49777	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.989445925 CET	49777	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.989993095 CET	49793	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.990008116 CET	443	49793	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.990106106 CET	49793	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.990335941 CET	49793	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:32.990344048 CET	443	49793	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:32.994856119 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.994920969 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.994975090 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.994990110 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.995027065 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.995032072 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.995055914 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.995085001 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.995105028 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.995868921 CET	49778	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.995878935 CET	443	49778	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.996412039 CET	49795	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.996444941 CET	443	49795	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:32.996509075 CET	49795	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.996691942 CET	49795	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:32.996704102 CET	443	49795	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.224483013 CET	443	49779	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.224534988 CET	443	49779	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.224596977 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.224596977 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.224613905 CET	443	49779	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.224729061 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.225419044 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.225455999 CET	443	49779	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.225501060 CET	49779	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.226236105 CET	49796	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.226295948 CET	443	49796	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.226361990 CET	49796	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.226696014 CET	49796	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.226710081 CET	443	49796	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.524497986 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.524581909 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.525331974 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.525391102 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.529256105 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.529268980 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.529500961 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.529550076 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.529941082 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.571326971 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.595875025 CET	443	49793	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.595938921 CET	49793	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.596699953 CET	443	49793	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.596755981 CET	49793	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.598350048 CET	49793	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.598354101 CET	443	49793	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.598586082 CET	443	49793	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.598628044 CET	49793	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.598923922 CET	49793	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.602464914 CET	443	49795	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.602533102 CET	49795	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.606242895 CET	49795	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.606251001 CET	443	49795	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.606611013 CET	443	49795	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.606868982 CET	49795	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.607187033 CET	49795	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.643321037 CET	443	49793	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.647325993 CET	443	49795	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.848978996 CET	443	49796	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.849060059 CET	49796	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.852171898 CET	49796	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.852191925 CET	443	49796	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.852659941 CET	443	49796	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.852711916 CET	49796	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.853679895 CET	49796	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.895340919 CET	443	49796	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.898051977 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.898108959 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.898135900 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.898196936 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.898257017 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.898299932 CET	443	49788	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.898363113 CET	49788	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.898788929 CET	49804	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.898821115 CET	443	49804	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.898988008 CET	49804	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.899152994 CET	49804	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.899164915 CET	443	49804	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.963002920 CET	49793	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.963121891 CET	49795	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.963304043 CET	49796	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.963327885 CET	49804	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.964538097 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.964571953 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.964667082 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.965224028 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.965245008 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.965801001 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.965836048 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.965894938 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.966923952 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.966949940 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:33.967058897 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.967863083 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:33.967876911 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:33.968193054 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:33.968208075 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.574026108 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.574137926 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.574807882 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.574815989 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.574985981 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.574992895 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.582216024 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.582289934 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.582988977 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.583055019 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.584800005 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.584814072 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.585074902 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.585130930 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.585433006 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.591686964 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.591762066 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.592473984 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.592529058 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.594074965 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.594083071 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.594320059 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.594388962 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.594706059 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.627327919 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.639332056 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.960371017 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.960591078 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.960635900 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.960697889 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.960743904 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.960792065 CET	443	49806	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.960845947 CET	49806	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.961419106 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.961451054 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.961574078 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.961822987 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.961832047 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.963838100 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.963861942 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.964210987 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.964210987 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.964248896 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.965066910 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.965146065 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.965159893 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.965214014 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.965249062 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.965352058 CET	443	49805	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.965408087 CET	49805	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.965681076 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.965689898 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.965764046 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.965924978 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:34.965934992 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:34.980585098 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.980629921 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.980663061 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.980671883 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.980695963 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.980726957 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.980823994 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.980823994 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.981429100 CET	49807	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.981450081 CET	443	49807	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.981923103 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.981965065 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:34.982029915 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.982194901 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:34.982208014 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:35.568738937 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.568844080 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.569808960 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.569869041 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.574918032 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.574928045 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.575212002 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.575284958 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.575831890 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.582005024 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:35.582077026 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:35.582555056 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:35.582561970 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:35.585143089 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:35.585150003 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:35.585469007 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.585558891 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.586344957 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.586406946 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.588329077 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.588339090 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.588687897 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.588747025 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.589126110 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.621232033 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:35.621335030 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:35.622582912 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:35.622592926 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:35.622828007 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:35.622832060 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:35.623337030 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.635328054 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.945719004 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.945780993 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.945807934 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.945857048 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.945991039 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.946014881 CET	443	49813	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.946096897 CET	49813	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.946789026 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.946831942 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.946892023 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.947196960 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.947206974 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.959045887 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.959352970 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.959361076 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.959393978 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.959489107 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.959511995 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.959640026 CET	443	49815	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.959685087 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.959701061 CET	49815	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.960325003 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.960350990 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:35.960392952 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.960830927 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:35.960843086 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.007463932 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.007507086 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.007553101 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.007553101 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.007576942 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.007630110 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.007690907 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.007690907 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.009094000 CET	49814	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.009109020 CET	443	49814	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.009114027 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.009140968 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.009212971 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.009856939 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.009864092 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.172013044 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.172061920 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.172076941 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.172103882 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.172111988 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.172137976 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.172141075 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.172163010 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.172177076 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.172204018 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.173125982 CET	49816	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.173136950 CET	443	49816	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.173759937 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.173799038 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.173894882 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.174293995 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.174299955 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.547137976 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.547215939 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.547941923 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.547992945 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.549825907 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.549830914 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.550133944 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.550180912 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.550630093 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.560022116 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.560081959 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.560753107 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.560797930 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.562318087 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.562326908 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.562915087 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.563061953 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.563293934 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.595320940 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.603327036 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.608432055 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.608485937 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.609092951 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.609097004 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.609343052 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.609347105 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.801527977 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.801615000 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.802134991 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.802140951 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.802335978 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:36.802341938 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:36.921899080 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.921957970 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.921989918 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.922034979 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.922117949 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.922161102 CET	443	49827	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.922224998 CET	49827	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.923039913 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.923083067 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.923181057 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.923813105 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.923825026 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.930267096 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.930326939 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.930340052 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.930386066 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.930536985 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.930619001 CET	443	49828	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.930674076 CET	49828	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.931165934 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.931206942 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:36.931353092 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.932090998 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:36.932101965 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.022278070 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.022355080 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.022372961 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.022382975 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.022427082 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.022444010 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.022494078 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.022497892 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.022530079 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.022547007 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.022581100 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.023693085 CET	49829	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.023709059 CET	443	49829	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.024430990 CET	49840	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.024475098 CET	443	49840	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.024539948 CET	49840	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.024851084 CET	49840	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.024861097 CET	443	49840	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.210802078 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.210855007 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.210864067 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.210885048 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.210918903 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.210947990 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.210952997 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.210978031 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.211107016 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.211818933 CET	49830	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.211833954 CET	443	49830	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.212476015 CET	49841	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.212519884 CET	443	49841	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.212599993 CET	49841	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.212877035 CET	49841	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.212888002 CET	443	49841	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.525832891 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.525954008 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.526613951 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.526702881 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.530249119 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.530265093 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.530556917 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.530633926 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.531060934 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.532156944 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.532226086 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.532912970 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.532968998 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.534392118 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.534401894 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.534641027 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.534686089 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.534992933 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.571325064 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.575323105 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.623881102 CET	443	49840	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.623940945 CET	49840	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.624458075 CET	49840	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.624469995 CET	443	49840	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.626458883 CET	49840	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.626466036 CET	443	49840	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.812037945 CET	443	49841	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.812103033 CET	49841	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.812694073 CET	49841	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.812707901 CET	443	49841	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.812879086 CET	49841	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.812886000 CET	443	49841	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.902117968 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.902177095 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.902185917 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.902229071 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.902286053 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.902303934 CET	443	49839	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.902316093 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.902355909 CET	49839	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.902990103 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.903012991 CET	443	49846	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.903073072 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.903305054 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.903323889 CET	443	49846	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.905783892 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.905837059 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.905858994 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.905910969 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.905950069 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.905991077 CET	443	49838	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.906037092 CET	49838	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.906425953 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.906455040 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.906512976 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.906858921 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:37.906873941 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:37.978431940 CET	49840	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.978564978 CET	49841	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.979186058 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.979223967 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.979298115 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.980443954 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.980463028 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.981683016 CET	49850	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.981720924 CET	443	49850	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:37.981834888 CET	49850	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.983721972 CET	49850	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:37.983736992 CET	443	49850	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.526176929 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.526274920 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.526995897 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.527100086 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.529304981 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.529324055 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.529668093 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.529757023 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.530121088 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.533849001 CET	443	49846	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.533929110 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.534626961 CET	443	49846	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.534692049 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.536525011 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.536550045 CET	443	49846	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.536887884 CET	443	49846	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.536947012 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.537345886 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.571342945 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.579339027 CET	443	49846	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.582374096 CET	443	49850	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.582429886 CET	49850	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.582962990 CET	49850	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.582973957 CET	443	49850	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.583157063 CET	49850	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.583163023 CET	443	49850	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.584290028 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.584460974 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.584758997 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.584767103 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.584914923 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.584918976 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.895195007 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.895287991 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.895333052 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.895435095 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.895500898 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.895548105 CET	443	49847	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.895606995 CET	49847	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.896509886 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.896616936 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.896698952 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.897001028 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.897028923 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.911794901 CET	443	49846	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.911874056 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.912015915 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.912059069 CET	443	49846	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.912116051 CET	49846	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.912797928 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.912822962 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.912951946 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.913173914 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:38.913182974 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:38.982970953 CET	443	49850	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.983026028 CET	443	49850	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.983120918 CET	443	49850	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.983119965 CET	49850	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.983215094 CET	49850	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.986768007 CET	49850	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.986790895 CET	443	49850	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.988023043 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.988054037 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:38.988157034 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.988392115 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:38.988399982 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.139352083 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.139480114 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.139481068 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.139509916 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.139529943 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.139578104 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.139657974 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.139816046 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.139873028 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.140424013 CET	49849	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.140441895 CET	443	49849	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.141089916 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.141133070 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.141205072 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.141447067 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.141460896 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.497555017 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.497656107 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.498312950 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.498374939 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.501921892 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.501929045 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.502167940 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.502219915 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.502641916 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.543040991 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.543226004 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.543351889 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.544228077 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.544306993 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.546143055 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.546178102 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.546533108 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.546674967 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.547101974 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.587362051 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.602658987 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.602797031 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.603454113 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.603461027 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.605223894 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.605227947 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.751374960 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.751445055 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.752439022 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.752459049 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.752677917 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:39.752691984 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:39.864082098 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.864144087 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.864168882 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.864209890 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.864315033 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.864347935 CET	443	49861	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.864407063 CET	49861	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.864957094 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.864993095 CET	443	49873	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.865068913 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.865323067 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.865335941 CET	443	49873	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.918576002 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.918647051 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.918665886 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.918699980 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.918720961 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.918754101 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.918816090 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.918828964 CET	443	49863	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.918838024 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.918876886 CET	49863	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.919454098 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.919497967 CET	443	49874	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:39.919574976 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.919858932 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:39.919872046 CET	443	49874	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.028389931 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.028440952 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.028541088 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.028561115 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.028572083 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.028606892 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.028942108 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.028981924 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.028991938 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.029032946 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.038588047 CET	49864	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.038606882 CET	443	49864	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.039232016 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.039258957 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.039333105 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.039623022 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.039637089 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.189914942 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.189961910 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.189990044 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.189999104 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.190006971 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.190049887 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.190053940 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.190063953 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.190089941 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.190114021 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.190798998 CET	49865	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.190807104 CET	443	49865	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.191204071 CET	49878	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.191232920 CET	443	49878	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.191302061 CET	49878	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.191493034 CET	49878	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.191504955 CET	443	49878	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.490467072 CET	443	49873	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.490554094 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.491148949 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.491162062 CET	443	49873	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.491364002 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.491369963 CET	443	49873	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.519912958 CET	443	49874	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.520020008 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.520512104 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.520523071 CET	443	49874	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.520564079 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.520570993 CET	443	49874	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.654937983 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.655023098 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.656069040 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.656084061 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.656270027 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.656275988 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.790337086 CET	443	49878	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.790404081 CET	49878	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.791028976 CET	49878	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.791047096 CET	443	49878	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.791232109 CET	49878	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:40.791239023 CET	443	49878	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:40.860641956 CET	443	49873	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.860780954 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.860816002 CET	443	49873	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.860869884 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.861038923 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.861083031 CET	443	49873	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.861138105 CET	49873	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.861805916 CET	49882	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.861840010 CET	443	49882	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.861911058 CET	49882	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.863286972 CET	49882	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.863300085 CET	443	49882	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.891251087 CET	443	49874	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.891427040 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.891452074 CET	443	49874	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.891514063 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.891645908 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.891690016 CET	443	49874	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.891753912 CET	49874	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.892405987 CET	49885	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.892446995 CET	443	49885	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:40.892563105 CET	49885	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.892836094 CET	49885	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:40.892849922 CET	443	49885	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:41.065313101 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.065366983 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.065421104 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.065448999 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.065463066 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.065481901 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.065500975 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.065541983 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.066530943 CET	49875	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.066549063 CET	443	49875	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.067173958 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.067203045 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.067269087 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.067549944 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.067565918 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.210297108 CET	443	49878	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.210351944 CET	443	49878	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.210460901 CET	443	49878	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.210486889 CET	49878	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.210534096 CET	49878	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.211704016 CET	49878	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.211726904 CET	443	49878	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.212364912 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.212424994 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.212513924 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.212990999 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.213005066 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.465508938 CET	443	49882	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:41.465605021 CET	49882	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:41.466157913 CET	443	49882	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:41.466227055 CET	49882	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:41.500194073 CET	443	49885	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:41.500291109 CET	49885	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:41.500976086 CET	443	49885	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:41.501087904 CET	49885	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:41.694341898 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.694413900 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:41.822364092 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:41.822432041 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:49.811342955 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:49.811366081 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:49.811531067 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:49.811567068 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:49.813914061 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:49.813921928 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:49.816178083 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:49.816198111 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:49.816920042 CET	49885	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:49.816939116 CET	443	49885	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:49.817286015 CET	443	49885	142.250.186.174	192.168.2.5
Dec 30, 2024 11:46:49.817338943 CET	49885	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:50.151525021 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.151575089 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.151598930 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:50.151621103 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.151638985 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:50.151655912 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:50.151663065 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.151686907 CET	443	49889	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.151704073 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:50.151735067 CET	49889	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:50.293272972 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.293325901 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.293343067 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:50.293371916 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.293390036 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:50.293432951 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:50.293477058 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.293514967 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:50.293519020 CET	443	49890	142.250.186.129	192.168.2.5
Dec 30, 2024 11:46:50.293572903 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:51.675201893 CET	49713	80	192.168.2.5	69.42.215.252
Dec 30, 2024 11:46:51.675837040 CET	49885	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:51.675842047 CET	49882	443	192.168.2.5	142.250.186.174
Dec 30, 2024 11:46:51.675923109 CET	49890	443	192.168.2.5	142.250.186.129
Dec 30, 2024 11:46:51.675926924 CET	49889	443	192.168.2.5	142.250.186.129

UDP Packets

Timestamp	Source Port	Dest Port	Source IP	Dest IP
Dec 30, 2024 11:46:21.128921986 CET	65471	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:46:21.136051893 CET	53	65471	1.1.1.1	192.168.2.5
Dec 30, 2024 11:46:22.046730042 CET	54573	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:46:22.053828955 CET	53	54573	1.1.1.1	192.168.2.5
Dec 30, 2024 11:46:22.057010889 CET	59156	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:46:22.063852072 CET	53	59156	1.1.1.1	192.168.2.5
Dec 30, 2024 11:46:22.153059959 CET	57261	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:46:22.160037994 CET	53	57261	1.1.1.1	192.168.2.5
Dec 30, 2024 11:46:28.324518919 CET	49805	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:46:28.331446886 CET	53	49805	1.1.1.1	192.168.2.5
Dec 30, 2024 11:46:32.855464935 CET	55521	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:46:32.862793922 CET	53	55521	1.1.1.1	192.168.2.5
Dec 30, 2024 11:46:38.527157068 CET	57108	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:46:38.651379108 CET	53	57108	1.1.1.1	192.168.2.5
Dec 30, 2024 11:46:42.054269075 CET	53	59592	162.159.36.2	192.168.2.5
Dec 30, 2024 11:46:42.573746920 CET	65012	53	192.168.2.5	1.1.1.1
Dec 30, 2024 11:46:42.584916115 CET	53	65012	1.1.1.1	192.168.2.5

DNS Queries

Timestamp	Source IP	Dest IP	Trans ID	OP Code	Name	Type	Class	DNS over HTTPS
Dec 30, 2024 11:46:21.128921986 CET	192.168.2.5	1.1.1.1	0xa573	Standard query (0)	docs.google.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:22.046730042 CET	192.168.2.5	1.1.1.1	0x616d	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:22.057010889 CET	192.168.2.5	1.1.1.1	0x1a3a	Standard query (0)	freedns.afraid.org	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:22.153059959 CET	192.168.2.5	1.1.1.1	0xeb24	Standard query (0)	drive.usercontent.google.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:28.324518919 CET	192.168.2.5	1.1.1.1	0x34bb	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:32.855464935 CET	192.168.2.5	1.1.1.1	0x5a6	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:38.527157068 CET	192.168.2.5	1.1.1.1	0xe480	Standard query (0)	xred.mooo.com	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:42.573746920 CET	192.168.2.5	1.1.1.1	0xb282	Standard query (0)	18.31.95.13.in-addr.arpa	PTR (Pointer record)	IN (0x0001)	false

DNS Answers

Timestamp	Source IP	Dest IP	Trans ID	Reply Code	Name	CName	Address	Type	Class	DNS over HTTPS
Dec 30, 2024 11:46:21.136051893 CET	1.1.1.1	192.168.2.5	0xa573	No error (0)	docs.google.com		142.250.186.174	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:22.053828955 CET	1.1.1.1	192.168.2.5	0x616d	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:22.063852072 CET	1.1.1.1	192.168.2.5	0x1a3a	No error (0)	freedns.afraid.org		69.42.215.252	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:22.160037994 CET	1.1.1.1	192.168.2.5	0xeb24	No error (0)	drive.usercontent.google.com		142.250.186.129	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:28.331446886 CET	1.1.1.1	192.168.2.5	0x34bb	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:31.228234053 CET	1.1.1.1	192.168.2.5	0xbe9a	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	s-part-0017.t-0009.t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 11:46:31.228234053 CET	1.1.1.1	192.168.2.5	0xbe9a	No error (0)	s-part-0017.t-0009.t-msedge.net		13.107.246.45	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:32.862793922 CET	1.1.1.1	192.168.2.5	0x5a6	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:38.651379108 CET	1.1.1.1	192.168.2.5	0xe480	Name error (3)	xred.mooo.com	none	none	A (IP address)	IN (0x0001)	false
Dec 30, 2024 11:46:42.584916115 CET	1.1.1.1	192.168.2.5	0xb282	Name error (3)	18.31.95.13.in-addr.arpa	none	none	PTR (Pointer record)	IN (0x0001)	false
Dec 30, 2024 11:47:25.072199106 CET	1.1.1.1	192.168.2.5	0x8880	No error (0)	shed.dual-low.s-part-0017.t-0009.t-msedge.net	azurefd-t-fb-prod.trafficmanager.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 11:47:25.072199106 CET	1.1.1.1	192.168.2.5	0x8880	No error (0)	dual.s-part-0017.t-0009.fb-t-msedge.net	s-part-0017.t-0009.fb-t-msedge.net		CNAME (Canonical name)	IN (0x0001)	false
Dec 30, 2024 11:47:25.072199106 CET	1.1.1.1	192.168.2.5	0x8880	No error (0)	s-part-0017.t-0009.fb-t-msedge.net		13.107.253.45	A (IP address)	IN (0x0001)	false

HTTP Request Dependency Graph

docs.google.com

drive.usercontent.google.com

freedns.afraid.org

HTTP Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49713	69.42.215.252	80	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
Dec 30, 2024 11:46:22.070152998 CET	154	OUT	GET /api/?action=getdyndns&sha=a30fa98efc092684e8d1c5cff797bcc613562978 HTTP/1.1 User-Agent: MyApp Host: freedns.afraid.org Cache-Control: no-cache
Dec 30, 2024 11:46:22.654459953 CET	243	IN	HTTP/1.1 200 OK Server: nginx Date: Mon, 30 Dec 2024 10:46:22 GMT Content-Type: text/html; charset=UTF-8 Transfer-Encoding: chunked Connection: keep-alive Vary: Accept-Encoding X-Cache: MISS Data Raw: 31 66 0d 0a 45 52 52 4f 52 3a 20 43 6f 75 6c 64 20 6e 6f 74 20 61 75 74 68 65 6e 74 69 63 61 74 65 2e 0a 0d 0a 30 0d 0a 0d 0a Data Ascii: 1fERROR: Could not authenticate.0

HTTPS Proxied Packets

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
0	192.168.2.5	49710	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:21 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-Juf-uU04G4juQUYilCrJEQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
1	192.168.2.5	49709	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:21 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:22 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-Qe04uH6CxBwTc41mXccaew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
2	192.168.2.5	49714	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:22 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:22 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-YLUm3oMG1uB-HBIJ1IJRPQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
3	192.168.2.5	49717	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:22 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:46:23 UTC	1602	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5jEhBcWx3sRRM4WZuFl_r-sXa1SCE-JtoxSHHzZ_dDCkofAOrf1X5kSKU5lp7ru2-r5OIj91w Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:23 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-BfyCk6bHpOewH1saaVnLVg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=BBE26vPeC2hszqsXJ1ynrQW_9kLsZpsHYQPDP6eN2y2zdlFo-23O9GeRsAmPENzIlI7naznndqiKAzIJmuZItjQAXwfSAfPPnvZybJ9AaZfi_PUMO8gtrIeAc_xFc3PJOBW4tiY_9Etp3P_tRX_kZ_fi85pZ8xHBt0DyAqqJlwGZY_uPHd-1V5ba; expires=Tue, 01-Jul-2025 10:46:23 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:23 UTC	1602	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 57 4e 74 6b 72 43 4f 4d 63 6c 7a 4a 7a 7a 57 6e 68 47 6f 51 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0WNtkrCOMclzJzzWnhGoQQ">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:46:23 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
4	192.168.2.5	49716	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:22 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:23 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-DkgbwxGl8_jgbqhD2OQGpA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
5	192.168.2.5	49715	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:22 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:46:23 UTC	1602	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5PqNcK1rReNjhVhnt2YfE2vXAFa4Su6ooWKO68EeyIYFcOUzZ96bepjVF7_Pgfpyvw8fBohTU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:23 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-y1gv4eopPdMqwlpUe6prDA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs; expires=Tue, 01-Jul-2025 10:46:23 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:23 UTC	1602	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 68 78 76 31 46 50 74 76 50 4f 59 58 2d 35 54 44 30 44 49 75 53 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="hxv1FPtvPOYX-5TD0DIuSA">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:46:23 UTC	50	IN	Data Raw: 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: is server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
6	192.168.2.5	49719	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:23 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-3iRJdEkbyrbo_Hl0aGE2qg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
7	192.168.2.5	49720	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:23 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:24 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-12j_YRRyxMBeDMsReuR2rg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
8	192.168.2.5	49721	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:23 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:46:24 UTC	1594	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7KL3WGOmHGwIlJfUTtBVGOya9N_kCo6q9qyMXNpWiNXcfDUh72JcWtvOAuSnICovmZ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:24 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-QHIHeyzzJ3QW49Q7PNz5ew' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ; expires=Tue, 01-Jul-2025 10:46:24 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:24 UTC	1594	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 46 79 53 59 58 32 70 53 54 54 56 63 6d 31 4e 43 78 66 6e 6a 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="RFySYX2pSTTVcm1NCxfnjw">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:46:24 UTC	58	IN	Data Raw: 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: nd on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
9	192.168.2.5	49722	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:24 UTC	186	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive
2024-12-30 10:46:24 UTC	1601	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7Gn29z9D7JZU6RY8EDTBJ9ct_1-Ddi2pR44YfZC2hYrMVLuB34PLL_5mjRm-YdbBGQzCt50gs Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:24 GMT P3P: CP="This is not a P3P policy! See g.co/p3phelp for more info." Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: script-src 'report-sample' 'nonce-WztmJEkd3N1en903BUi2SQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Set-Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg; expires=Tue, 01-Jul-2025 10:46:24 GMT; path=/; domain=.google.com; HttpOnly Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:24 UTC	1601	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 49 72 52 4f 62 52 4c 48 50 4a 5f 33 46 39 42 67 4a 4b 63 4d 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (Not Found)!!1</title><style nonce="0IrRObRLHPJ_3F9BgJKcMA">*{margin:0;padding:0}html,code{font:15px/22px arial
2024-12-30 10:46:24 UTC	51	IN	Data Raw: 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: his server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
10	192.168.2.5	49723	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:24 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-wBov9MDRtYofUT7lnZYCcg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
11	192.168.2.5	49724	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:24 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:25 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:24 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-lCM-VOi4GB8ojWalwACLCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
12	192.168.2.5	49725	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:24 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
2024-12-30 10:46:25 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC65GHuUhtBjlaYCUURTznVflu6pJrqucO2NsOGhBhXV859lP0SoGFuXjy-J7cIPVhcA9NyjIjQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:25 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-bh9ThQyCviSXW9TAZPP2pw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:25 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:25 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 55 73 4c 79 6b 44 51 30 77 72 32 54 34 57 35 39 4c 4a 46 4c 55 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="UsLykDQ0wr2T4W59LJFLUA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:25 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
13	192.168.2.5	49728	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:25 UTC	388	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
2024-12-30 10:46:25 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7iLvb8YJnSAOAxRgJu6jit2o2nXZp4Xyq2neJoC-26-ZfsN19OKmABu3ti7riL9run Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:25 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-52CMQh1NzCaUhZ7y8Uhr2A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:25 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:25 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6a 48 59 50 70 55 50 6e 38 46 76 30 6d 54 56 42 76 50 4f 55 7a 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="jHYPpUPn8Fv0mTVBvPOUzA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:25 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
14	192.168.2.5	49730	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:25 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
15	192.168.2.5	49731	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:25 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
16	192.168.2.5	49733	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:25 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
17	192.168.2.5	49737	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:26 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-yKhE5hexeVSqOy4sJToPTA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
18	192.168.2.5	49738	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:26 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:26 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:26 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-DA5IPM1B_d0HVlMsmRfJXQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
19	192.168.2.5	49743	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:27 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:27 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6BihuvC21EXEIS39FTaH0fJlyF9JdWf_xS_PbyTTwFwj8NALRBrdgRphFz-hZAKJkI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:27 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-XKEdl4sY34ADx8AOdZvzfg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:27 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:27 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 73 4d 63 6f 39 33 6a 67 72 2d 50 37 6c 34 6f 62 32 38 5f 6d 4e 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="sMco93jgr-P7l4ob28_mNw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:27 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
20	192.168.2.5	49744	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:27 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-nt0rBTc-RMKhhEpgiFQbQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
21	192.168.2.5	49746	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:27 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:27 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:27 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MBXR2iG_HwrPu6YsjZFs6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
22	192.168.2.5	49745	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:27 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:28 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4lRxXvKqntFmAv49Kt_DmVIJBv-cyzvu61-qlSY2NoyyDWxGmrAl7dD6TqXaJJF4jAq4R8KE8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:27 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-5Tf15NjmFzJ_KpNbum2L9A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:28 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:28 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 35 46 2d 62 57 38 6e 59 73 39 4f 33 4c 4e 65 4e 39 69 58 55 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="X5F-bW8nYs9O3LNeN9iXUA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:28 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
23	192.168.2.5	49748	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:28 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-738MzlKf9szwGz3F7maLsg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
24	192.168.2.5	49749	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:28 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:28 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4V4EcuqXGEyBy--vxWpRD16bls4hrnar4F-wnXNfyOl-LglW7VWHeyq1uTZibe7pqeNLajpWU Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:28 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-thT4M306q7AMBhXZYfMdpw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:28 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:28 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 44 45 77 58 32 34 47 52 6e 46 63 41 35 52 68 7a 35 7a 4d 58 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="3DEwX24GRnFcA5Rhz5zMXA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:28 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
25	192.168.2.5	49750	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:28 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:28 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:28 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-L7Iwnk2xtmxswJESoLB5fg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
26	192.168.2.5	49751	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:28 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:29 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4pHj7yTg57lqWyJoWRdz0WXUcltGR-Kn-KyNJuyDZlG8Us2omXWAnt7DPTftgRPnDj Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:28 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-QNLp2Me4-0lJgGtoff4mhw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:29 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:29 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 35 6e 4e 70 4d 62 41 62 49 67 34 51 4b 66 52 78 44 74 6f 4d 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="M5nNpMbAbIg4QKfRxDtoMg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:29 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
27	192.168.2.5	49754	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:29 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-eEao1iz8-KN_VDrqRQ7k9w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
28	192.168.2.5	49755	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:29 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:29 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:29 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Hugc7uTB3nqWQEYoFRNcEg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
29	192.168.2.5	49756	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:29 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
30	192.168.2.5	49758	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:29 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
31	192.168.2.5	49764	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:30 UTC	143	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache
2024-12-30 10:46:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-cIv5irt1Ix__ooFgOFFQKw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
32	192.168.2.5	49765	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:30 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:30 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7psqz03pYJdyF-3-vzKK6TQNaVxe4RVeja77z5QcFNFOgZn9R60PB0PEIwrXjakT9y Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:30 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-k5Qi4i2LOPmJ6iX7UQ9XCw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:30 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:30 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 70 62 51 75 46 76 71 4e 33 6d 6a 6a 62 59 6a 49 47 63 31 67 59 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="pbQuFvqN3mjjbYjIGc1gYw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:30 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
33	192.168.2.5	49766	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:30 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:31 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5rZFDVBRDrnDzLfjzUqEGWebBGL4LCaCnJId78kvhzF8qbVVQZHNVMrkNIVHiIcR50MkxczG4 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:30 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-Qewve3RB0NYr2ccV7nWqxA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:31 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:31 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 30 74 7a 53 33 70 5a 63 5f 79 68 69 6b 41 6e 41 66 64 6f 59 63 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="0tzS3pZc_yhikAnAfdoYcQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:31 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
34	192.168.2.5	49767	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:30 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=BBE26vPeC2hszqsXJ1ynrQW_9kLsZpsHYQPDP6eN2y2zdlFo-23O9GeRsAmPENzIlI7naznndqiKAzIJmuZItjQAXwfSAfPPnvZybJ9AaZfi_PUMO8gtrIeAc_xFc3PJOBW4tiY_9Etp3P_tRX_kZ_fi85pZ8xHBt0DyAqqJlwGZY_uPHd-1V5ba
2024-12-30 10:46:30 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:30 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-wzXQDOTOSBLxiaaws8IOsQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
35	192.168.2.5	49770	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:31 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
2024-12-30 10:46:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-FJzHWm9vR-U7wHl8fmBqlA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
36	192.168.2.5	49769	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:31 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=BBE26vPeC2hszqsXJ1ynrQW_9kLsZpsHYQPDP6eN2y2zdlFo-23O9GeRsAmPENzIlI7naznndqiKAzIJmuZItjQAXwfSAfPPnvZybJ9AaZfi_PUMO8gtrIeAc_xFc3PJOBW4tiY_9Etp3P_tRX_kZ_fi85pZ8xHBt0DyAqqJlwGZY_uPHd-1V5ba
2024-12-30 10:46:31 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:31 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: script-src 'report-sample' 'nonce-KXlIjIpy-41N2RR7nG1KzA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
37	192.168.2.5	49771	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:31 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:31 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4qyV9TWFqT9NnLWWOjZYA8acCeA_ddnAk_YucCUym_fP0EL2rTwoZRQTtnSJ8ZBicZ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:31 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-peMrP7kaTL3aP7sXMcNaZA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:31 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:31 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 50 57 62 6c 66 69 45 61 58 55 6d 6e 4a 2d 59 62 53 6d 33 36 31 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="PWblfiEaXUmnJ-YbSm361w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:31 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
38	192.168.2.5	49772	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:31 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:32 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5lsNClKSn5db9bU27Uyje9Z6XOKQrrvv7dyL4mfiJPEOW039smoGvvtaR_2xamTH1X Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:32 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-R7Q5-sFlFXCUwa2vSh0KVw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:32 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:32 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 38 76 78 35 58 36 46 47 41 64 76 4e 66 67 5a 47 66 67 7a 47 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="M8vx5X6FGAdvNfgZGfgzGw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:32 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
39	192.168.2.5	49776	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:32 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
2024-12-30 10:46:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-GFn9Uken2U0THRpMjpaPiw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
40	192.168.2.5	49778	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:32 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:32 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4BlNKBlY0iR8c48VlhhnGUzOzC4Qy9QSB-P5O2y7NZ2lfT2tsOcH_dgd5NGiMyatLlq0ng5vY Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:32 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-hpP6T0Ritup_f1cssajd4Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:32 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:32 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 57 62 56 57 57 61 65 7a 33 56 53 68 35 75 6c 5f 59 52 51 6f 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="DWbVWWaez3VSh5ul_YRQog">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:32 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
41	192.168.2.5	49777	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:32 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
2024-12-30 10:46:32 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:32 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-zRgn4ilA1YqvmwSqB5fdGw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
42	192.168.2.5	49779	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:32 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:33 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6dMrQDPsApcCtUzrwevCuvLGZGLQ7h8yXvstPvAW_x9-BovWjD8dnLWro_idiIVX0Zg-g-a68 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:33 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-tumOFnVyVHgbKwJ9zWSZFA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:33 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:33 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 7a 64 76 44 34 79 66 45 42 36 58 68 37 61 74 67 2d 6a 6e 4e 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="DzdvD4yfEB6Xh7atg-jnNg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:33 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
43	192.168.2.5	49788	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:33 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
2024-12-30 10:46:33 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:33 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-lfTwmwcCAnziAO0MVyhJJA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
44	192.168.2.5	49793	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:33 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
45	192.168.2.5	49795	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:33 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
46	192.168.2.5	49796	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:33 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
47	192.168.2.5	49807	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:34 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:34 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7INzbUNYBFIBWutVzZk2kxWKrVWj0m8vfLwFTpU9lhY6UIkWgLH9_jP_5jCTI2yAkJhiFAS7E Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:34 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-O_5y2BxyfTnfbedJ6JuFhg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:34 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:34 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 44 34 4c 53 72 67 79 6d 67 78 78 70 49 46 75 71 6a 35 6d 31 72 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="D4LSrgymgxxpIFuqj5m1rQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:34 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
48	192.168.2.5	49806	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:34 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
2024-12-30 10:46:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-KzV_YcqgZwUpxx_SmLzu0g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port
49	192.168.2.5	49805	142.250.186.174	443

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:34 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
2024-12-30 10:46:34 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:34 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-Dctp2acIbG4NIDuLz4p3Tw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
50	192.168.2.5	49813	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:35 UTC	345	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=FQNrFMPCubAKFj9y0Z4k1ouEUX4Kui-QjTdr291lluRJVHeBtM1mmeusg_KkXpwdOwLJs5cOvnhmTLnOvRQR4IVppbf3RIy65RY9Q-WoT2r9-CIWSaAiRQVqHD4q_Ul2GM-1Je42Oomn7qeJ5CNwHAcFXx9lSOPP_EtpXCcGhvcSUwTGnBqeegrs
2024-12-30 10:46:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-_L0y7eANwOWQoIWf1zgSdA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
51	192.168.2.5	49814	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:35 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:36 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7_LzXVOPHk1zy02ujums4x9ocqNfziH5KRqyHhfc-E82tlFT6RoJQ6MthNPi-X19VV Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:35 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-33GJqMlK8Jsh_0Pp8Arv6Q' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:36 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:36 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 52 30 51 74 55 4a 56 30 2d 70 73 53 34 39 76 34 38 64 49 50 6b 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="R0QtUJV0-psS49v48dIPkg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:36 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
52	192.168.2.5	49815	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:35 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ
2024-12-30 10:46:35 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:35 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-yd-y3ApeeLp9LDiwfFaXhQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
53	192.168.2.5	49816	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:35 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:36 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5sGdVSkZMHNf8RKW2yNZtrtIcJCFmJ6NJZBpy6HPbStB5eXRKI0AthS24HA6soaUv_ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:36 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-zoIHPCHMHKSeV-G3pnaCvw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:36 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:36 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 49 49 35 33 7a 45 39 76 78 4c 67 6d 39 79 6b 50 6d 43 72 78 5a 51 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="II53zE9vxLgm9ykPmCrxZQ">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:36 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
54	192.168.2.5	49827	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:36 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ
2024-12-30 10:46:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-ME6CrGV8O-BFv_rlDQ0qMg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
55	192.168.2.5	49828	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:36 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ
2024-12-30 10:46:36 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:36 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-iw4KhzvEQrQsTPZmqA8zQg' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
56	192.168.2.5	49829	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:36 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:37 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4SRYTN8JCguFe6pxvW1q4j_sxTbwuWY-PyogfFpjcEVAbfpPY12e1do2gxs8IGDcs39Kevjyk Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:36 GMT Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-LZr15ntIk5bahUJ8WV0OpQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:37 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:37 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4f 62 5a 61 6d 6b 61 32 37 35 62 49 32 54 4f 59 64 6e 58 37 69 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="ObZamka275bI2TOYdnX7iw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:37 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
57	192.168.2.5	49830	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:36 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:37 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4Ue6LrGCymefIM-wbLv0yeXqHbDzzCCABWpzeN9oUSFgVTpklSoq1MqVzdWTl3MRxfGEoHal8 Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:37 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-BTlHEkSFFbaUvAwNzkrKwA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:37 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:37 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 58 5f 45 6b 65 56 43 4c 53 55 51 36 55 46 78 78 2d 44 5a 45 67 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="X_EkeVCLSUQ6UFxx-DZEgA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:37 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
58	192.168.2.5	49838	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:37 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=AjF33IdaeUNmHlmeyv_rklrZSnVFv8lgySmei1Dsqdy2rFxSjjfnAO-cl39aHo2JrrTKdNoIFV6ku8M9RkVKkd4wDR3j0NCN6DfoPbxsWlGAYN6sqEfJqKWWg0zy5MERV4xjBejEASTfCcn004MOi4zjgfmGet7SvpsNHYPAqhjQfvoi6GZ98aQ
2024-12-30 10:46:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-egeHxUFmJ1uMZKOnddUubQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
59	192.168.2.5	49839	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:37 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:37 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:37 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-0ajOwWhpVRqqj2Rc-tGrqA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
60	192.168.2.5	49840	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:37 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
61	192.168.2.5	49841	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:37 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
62	192.168.2.5	49847	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:38 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce--K-zLqGBFP9E3mnv3GhKYQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
63	192.168.2.5	49846	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:38 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:38 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:38 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-IFyxi3uT8UyWel7UTD9eSA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
64	192.168.2.5	49850	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:38 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:38 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC4xjACCzHWQkpTnzF4IdBeJWsbwQ8Wt4lz6MUoOTPLpvjzfwRJ9EWn_41ql3JpGIsvDEYJk17A Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:38 GMT Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-E2vbfZLdLrHL0K0ASADqig' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:38 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:38 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 77 59 79 6d 78 38 5f 6e 68 52 59 41 39 61 34 77 75 41 45 64 73 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="wYymx8_nhRYA9a4wuAEdsA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:38 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
65	192.168.2.5	49849	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:38 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:39 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5MBK4o0TL8mdsA9J_jz_jBMxJf5q5LcYOKlflX-LyYD2qvXCQEKPOnO5abtACBsHcD Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:38 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-MW0amh_X7GCwXdQ2VnB8uQ' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:39 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:39 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4b 36 47 5f 49 63 63 6e 54 49 76 31 47 4e 75 4f 4b 46 64 41 2d 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="K6G_IccnTIv1GNuOKFdA-w">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:39 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
66	192.168.2.5	49861	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:39 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-7G5lKBMeXpAb5cyR9_o3-w' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
67	192.168.2.5	49863	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:39 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:39 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:39 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Security-Policy: script-src 'report-sample' 'nonce-_S933YDnCjqmL6qQj4WS4g' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
68	192.168.2.5	49864	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:39 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:40 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC6gV8BCzfGuYQhN2yQ05qyRfLlKtyL6XvkoLqYy93hb7MqCKY0TvNVdZgM37-M3sCTF Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:39 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-hIn7nv2L5sbpFkff6ZyNjw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:40 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:40 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 42 79 73 4b 41 4d 64 50 6a 45 77 4d 30 71 5a 61 52 5f 64 6d 69 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="BysKAMdPjEwM0qZaR_dmiw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:40 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
69	192.168.2.5	49865	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:39 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:40 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC58Y-WbYDfyGcg6wNq57iZrlxztHUeya1O6ZVbIzyhqI7l-uSMtHQVLwmgRjhfZ8QPdB0YN0GE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:40 GMT Content-Security-Policy: script-src 'report-sample' 'nonce-BgGfeNyE0wB1fa_h8G_ofw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:40 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:40 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 4d 76 59 51 63 44 6f 71 36 46 6f 75 67 58 48 36 41 53 68 54 57 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="MvYQcDoq6FougXH6AShTWA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:40 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
70	192.168.2.5	49873	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:40 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce--3CYfnkfBEjlRCC2dlAKzw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
71	192.168.2.5	49874	142.250.186.174	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:40 UTC	344	OUT	GET /uc?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Host: docs.google.com Cache-Control: no-cache Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:40 UTC	1314	IN	HTTP/1.1 303 See Other Content-Type: application/binary Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:40 GMT Location: https://drive.usercontent.google.com/download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download Strict-Transport-Security: max-age=31536000 Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-J2JZS2QKHiHRO-Dgvgn9GA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Server: ESF Content-Length: 0 X-XSS-Protection: 0 X-Frame-Options: SAMEORIGIN X-Content-Type-Options: nosniff Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Connection: close

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
72	192.168.2.5	49875	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:40 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:41 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC59nJl1KRdaMi3b3O_E3ZsO6sRFUeM3hddZ0F46xi9LxbMV5wgJknNsLObLVMk51xAQ Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:40 GMT Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-Yq12V9ypN3Q7d5XeW16JRw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:41 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:41 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 6b 30 6f 55 77 77 64 51 42 72 38 57 4e 66 5a 30 36 57 72 64 58 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="k0oUwwdQBr8WNfZ06WrdXg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:41 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
73	192.168.2.5	49878	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:40 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:41 UTC	1243	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7H5jGutOktHQL-51asoFmk3Dwzs3TkdD0XYZuaA9Wm-FHmjpRaRWMym0CUKHi8Gd4R Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:41 GMT Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Content-Security-Policy: script-src 'report-sample' 'nonce-zpFUKac8DfKWTZbNXvnsAw' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Cross-Origin-Opener-Policy: same-origin Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:41 UTC	147	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 34 30 34 20 28 4e 6f Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error 404 (No
2024-12-30 10:46:41 UTC	1390	IN	Data Raw: 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 33 55 58 34 65 67 45 38 4f 63 48 76 4b 2d 46 70 73 44 74 5a 45 67 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b 70 61 64 64 69 6e 67 Data Ascii: t Found)!!1</title><style nonce="3UX4egE8OcHvK-FpsDtZEg">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;padding
2024-12-30 10:46:41 UTC	115	IN	Data Raw: 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: >Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
74	192.168.2.5	49889	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:49 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:50 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC7eZY5umXs1nM3GPXuVab-m0HSMYihxJVcFXhlRcztjSRDK6xK6i60iBio9CoXvly7fz8dlIHE Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:49 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-e50PC8pBzN40j-9n-PgyCA' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:50 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:50 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 39 65 4b 32 65 74 6b 6c 77 67 6b 52 6d 63 34 64 6e 38 6e 6e 50 77 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="9eK2etklwgkRmc4dn8nnPw">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:50 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Session ID	Source IP	Source Port	Destination IP	Destination Port	PID	Process
75	192.168.2.5	49890	142.250.186.129	443	6520	C:\ProgramData\Synaptics\Synaptics.exe

Timestamp	Bytes transferred	Direction	Data
2024-12-30 10:46:49 UTC	387	OUT	GET /download?id=0BxsMXGfPIZfSVlVsOGlEVGxuZVk&export=download HTTP/1.1 User-Agent: Synaptics.exe Cache-Control: no-cache Host: drive.usercontent.google.com Connection: Keep-Alive Cookie: NID=520=VNlPuwoZ5OU-bZQsx9lrCO_ozU3ysu5nqJQEAYxzknS3gd0rg70O1PiRSC_9BoYkGties1Mv4GNpnxFRuEe5f-8AVkun4ySFar50Jk345ljbdzssJ_0SeWPTxXbTManXOz5CEt4Wusfq2AYTcv5fd3EOhp7-ujBS3rjXxkhmjtlG800fmuC54Qg
2024-12-30 10:46:50 UTC	1250	IN	HTTP/1.1 404 Not Found X-GUploader-UploadID: AFiumC5HZPBfwWfJ54z6GnsFPZ38A-gGc6uoj3I-wV904YsrG3nJmCeWdLBgUoL6DQ6t5vlGf17lcMI Content-Type: text/html; charset=utf-8 Cache-Control: no-cache, no-store, max-age=0, must-revalidate Pragma: no-cache Expires: Mon, 01 Jan 1990 00:00:00 GMT Date: Mon, 30 Dec 2024 10:46:50 GMT Cross-Origin-Opener-Policy: same-origin Content-Security-Policy: require-trusted-types-for 'script';report-uri /_/DriveUntrustedContentHttp/cspreport Content-Security-Policy: script-src 'report-sample' 'nonce-v_G_P6LB-MOKZBKjJ2BQ3A' 'unsafe-inline';object-src 'none';base-uri 'self';report-uri /_/DriveUntrustedContentHttp/cspreport;worker-src 'self' Permissions-Policy: ch-ua-arch=, ch-ua-bitness=, ch-ua-full-version=, ch-ua-full-version-list=, ch-ua-model=, ch-ua-wow64=, ch-ua-form-factors=, ch-ua-platform=, ch-ua-platform-version=* Accept-CH: Sec-CH-UA-Arch, Sec-CH-UA-Bitness, Sec-CH-UA-Full-Version, Sec-CH-UA-Full-Version-List, Sec-CH-UA-Model, Sec-CH-UA-WoW64, Sec-CH-UA-Form-Factors, Sec-CH-UA-Platform, Sec-CH-UA-Platform-Version Content-Length: 1652 Server: UploadServer Alt-Svc: h3=":443"; ma=2592000,h3-29=":443"; ma=2592000 Content-Security-Policy: sandbox allow-scripts Connection: close
2024-12-30 10:46:50 UTC	140	IN	Data Raw: 3c 68 74 6d 6c 20 6c 61 6e 67 3d 22 65 6e 22 20 64 69 72 3d 6c 74 72 3e 3c 6d 65 74 61 20 63 68 61 72 73 65 74 3d 75 74 66 2d 38 3e 3c 6d 65 74 61 20 6e 61 6d 65 3d 76 69 65 77 70 6f 72 74 20 63 6f 6e 74 65 6e 74 3d 22 69 6e 69 74 69 61 6c 2d 73 63 61 6c 65 3d 31 2c 20 6d 69 6e 69 6d 75 6d 2d 73 63 61 6c 65 3d 31 2c 20 77 69 64 74 68 3d 64 65 76 69 63 65 2d 77 69 64 74 68 22 3e 3c 74 69 74 6c 65 3e 45 72 72 6f 72 20 Data Ascii: <html lang="en" dir=ltr><meta charset=utf-8><meta name=viewport content="initial-scale=1, minimum-scale=1, width=device-width"><title>Error
2024-12-30 10:46:50 UTC	1390	IN	Data Raw: 34 30 34 20 28 4e 6f 74 20 46 6f 75 6e 64 29 21 21 31 3c 2f 74 69 74 6c 65 3e 3c 73 74 79 6c 65 20 6e 6f 6e 63 65 3d 22 78 46 56 32 37 67 6e 57 68 4f 55 42 52 53 58 76 71 67 54 4c 62 41 22 3e 2a 7b 6d 61 72 67 69 6e 3a 30 3b 70 61 64 64 69 6e 67 3a 30 7d 68 74 6d 6c 2c 63 6f 64 65 7b 66 6f 6e 74 3a 31 35 70 78 2f 32 32 70 78 20 61 72 69 61 6c 2c 73 61 6e 73 2d 73 65 72 69 66 7d 68 74 6d 6c 7b 62 61 63 6b 67 72 6f 75 6e 64 3a 23 66 66 66 3b 63 6f 6c 6f 72 3a 23 32 32 32 3b 70 61 64 64 69 6e 67 3a 31 35 70 78 7d 62 6f 64 79 7b 63 6f 6c 6f 72 3a 23 32 32 32 3b 74 65 78 74 2d 61 6c 69 67 6e 3a 75 6e 73 65 74 3b 6d 61 72 67 69 6e 3a 37 25 20 61 75 74 6f 20 30 3b 6d 61 78 2d 77 69 64 74 68 3a 33 39 30 70 78 3b 6d 69 6e 2d 68 65 69 67 68 74 3a 31 38 30 70 78 3b Data Ascii: 404 (Not Found)!!1</title><style nonce="xFV27gnWhOUBRSXvqgTLbA">*{margin:0;padding:0}html,code{font:15px/22px arial,sans-serif}html{background:#fff;color:#222;padding:15px}body{color:#222;text-align:unset;margin:7% auto 0;max-width:390px;min-height:180px;
2024-12-30 10:46:50 UTC	122	IN	Data Raw: 62 3e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6e 20 65 72 72 6f 72 2e 3c 2f 69 6e 73 3e 3c 70 3e 54 68 65 20 72 65 71 75 65 73 74 65 64 20 55 52 4c 20 77 61 73 20 6e 6f 74 20 66 6f 75 6e 64 20 6f 6e 20 74 68 69 73 20 73 65 72 76 65 72 2e 20 3c 69 6e 73 3e 54 68 61 74 e2 80 99 73 20 61 6c 6c 20 77 65 20 6b 6e 6f 77 2e 3c 2f 69 6e 73 3e 3c 2f 6d 61 69 6e 3e Data Ascii: b> <ins>Thats an error.</ins><p>The requested URL was not found on this server. <ins>Thats all we know.</ins></main>

Target ID:	0
Start time:	05:46:12
Start date:	30/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	"C:\Windows\System32\msiexec.exe" /i "C:\Users\user\Desktop\valyzt.msi"
Imagebase:	0x7ff6fc440000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Target ID:	1
Start time:	05:46:12
Start date:	30/12/2024
Path:	C:\Windows\System32\msiexec.exe
Wow64 process (32bit):	false
Commandline:	C:\Windows\system32\msiexec.exe /V
Imagebase:	0x7ff6fc440000
File size:	69'632 bytes
MD5 hash:	E5DA170027542E25EDE42FC54C929077
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	3
Start time:	05:46:13
Start date:	30/12/2024
Path:	C:\Windows\Installer\MSI4755.tmp
Wow64 process (32bit):	true
Commandline:	"C:\Windows\Installer\MSI4755.tmp"
Imagebase:	0x400000
File size:	1'723'904 bytes
MD5 hash:	71386F37F17778126296CA734975DB6D
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: 00000003.00000000.2035344533.0000000000401000.00000020.00000001.01000000.00000003.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\Windows\Installer\MSI4755.tmp, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\Windows\Installer\MSI4755.tmp, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	4
Start time:	05:46:14
Start date:	30/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe" InjUpdate
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	ACA4D70521DE30563F4F2501D4D686A5
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	Borland Delphi
Yara matches:	Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: 00000004.00000003.2105707960.0000000000773000.00000004.00000020.00020000.00000000.sdmp, Author: Joe Security Rule: JoeSecurity_XRed, Description: Yara detected XRed, Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security Rule: JoeSecurity_DelphiSystemParamCount, Description: Detected Delphi use of System.ParamCount(), Source: C:\ProgramData\Synaptics\Synaptics.exe, Author: Joe Security
Antivirus matches:	Detection: 100%, Avira Detection: 100%, Avira Detection: 100%, Joe Sandbox ML Detection: 92%, ReversingLabs
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	5
Start time:	05:46:15
Start date:	30/12/2024
Path:	C:\Program Files (x86)\Microsoft Office\root\Office16\EXCEL.EXE
Wow64 process (32bit):	true
Commandline:	"C:\Program Files (x86)\Microsoft Office\Root\Office16\EXCEL.EXE" /automation -Embedding
Imagebase:	0xf90000
File size:	53'161'064 bytes
MD5 hash:	4A871771235598812032C822E6F68F19
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	false

Show Windows behavior

Target ID:	8
Start time:	05:46:24
Start date:	30/12/2024
Path:	C:\ProgramData\Synaptics\Synaptics.exe
Wow64 process (32bit):	true
Commandline:	"C:\ProgramData\Synaptics\Synaptics.exe"
Imagebase:	0x400000
File size:	771'584 bytes
MD5 hash:	ACA4D70521DE30563F4F2501D4D686A5
Has elevated privileges:	false
Has administrator privileges:	false
Programmed in:	Borland Delphi
Reputation:	low
Has exited:	true

Show Windows behavior

Target ID:	12
Start time:	05:46:41
Start date:	30/12/2024
Path:	C:\Windows\SysWOW64\WerFault.exe
Wow64 process (32bit):	true
Commandline:	C:\Windows\SysWOW64\WerFault.exe -u -p 6520 -s 3156
Imagebase:	0xdf0000
File size:	483'680 bytes
MD5 hash:	C31336C1EFC2CCB44B4326EA793040F2
Has elevated privileges:	true
Has administrator privileges:	true
Programmed in:	C, C++ or other language
Reputation:	high
Has exited:	true

Show Windows behavior

Chronological Activities

Disassembly

⊘No disassembly

Description:	This technique has been deprecated. Please use Command and Scripting Interpreter where appropriate.
Tactics:	Defense Evasion, Execution
Data Sources:
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may move onto systems, possibly those on disconnected or air-gapped networks, by copying malware to removable media and taking advantage of Autorun features when the media is inserted into a system and executes. In the case of Lateral Movement, this may occur through modification of executable files stored on removable media or by copying malware and renaming it to look like a legitimate file to trick users into executing it on a separate system. In the case of Initial Access, this may occur through manual manipulation of the media, modification of systems used to initially format the media, or modification to the media's firmware itself.
Tactics:	Initial Access, Lateral Movement
Data Sources:	Drive: Drive Creation, File: File Access, File: File Creation, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may achieve persistence by adding a program to a startup folder or referencing it with a Registry run key. Adding an entry to the "run keys" in the Registry or startup folder will cause the program referenced to be executed when a user logs in.These programs will be executed under the context of the user and will have the account's associated permissions level.
Tactics:	Persistence, Privilege Escalation
Data Sources:	Command: Command Execution, File: File Modification, Process: Process Creation, Windows Registry: Windows Registry Key Creation, Windows Registry: Windows Registry Key Modification
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may execute their own malicious payloads by side-loading DLLs. Similar to DLL Search Order Hijacking , side-loading involves hijacking which DLL a program loads. But rather than just planting the DLL within the search order of a program then waiting for the victim application to be invoked, adversaries may directly side-load their payloads by planting then invoking a legitimate application that executes their payload(s).
Tactics:	Defense Evasion, Persistence, Privilege Escalation
Data Sources:	File: File Creation, File: File Modification, Module: Module Load, Process: Process Creation
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject code into processes in order to evade process-based defenses as well as possibly elevate privileges. Process injection is a method of executing arbitrary code in the address space of a separate live process. Running code in the context of another process may allow access to the process's memory, system/network resources, and possibly elevated privileges. Execution via process injection may also evade detection from security products since the execution is masked under a legitimate process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	File: File Metadata, File: File Modification, Module: Module Load, Process: OS API Execution, Process: Process Access, Process: Process Metadata, Process: Process Modification
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may inject malicious code into process via Extra Window Memory (EWM) in order to evade process-based defenses as well as possibly elevate privileges. EWM injection is a method of executing arbitrary code in the address space of a separate live process.
Tactics:	Defense Evasion, Privilege Escalation
Data Sources:	Process: OS API Execution
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to manipulate features of their artifacts to make them appear legitimate or benign to users and/or security tools. Masquerading occurs when the name or location of an object, legitimate or malicious, is manipulated or abused for the sake of evading defenses and observation. This may include manipulating file metadata, tricking users into misidentifying the file type, and giving legitimate task or service names.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Metadata, File: File Modification, Image: Image Metadata, Process: OS API Execution, Process: Process Creation, Process: Process Metadata, Scheduled Job: Scheduled Job Metadata, Scheduled Job: Scheduled Job Modification, Service: Service Creation, Service: Service Metadata
Platforms:	Containers, Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ various means to detect and avoid virtualization and analysis environments. This may include changing behaviors based on the results of checks for the presence of artifacts indicative of a virtual machine environment (VME) or sandbox. If the adversary detects a VME, they may alter their malware to disengage from the victim or conceal the core functions of the implant. They may also search for VME artifacts before dropping secondary or additional payloads. Adversaries may use the information learned from [Virtualization/Sandbox Evasion](https://attack.mitre.org/techniques/T1497) during automated discovery to shape follow-on behaviors.
Tactics:	Defense Evasion, Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to make an executable or file difficult to discover or analyze by encrypting, encoding, or otherwise obfuscating its contents on the system or in transit. This is common behavior that can be used across different platforms and the network to evade defenses.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Creation, File: File Metadata, Module: Module Load, Process: OS API Execution, Process: Process Creation, Script: Script Execution, WMI: WMI Creation, Windows Registry: Windows Registry Key Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may perform software packing or virtual machine software protection to conceal their code. Software packing is a method of compressing or encrypting an executable. Packing an executable changes the file signature in an attempt to avoid signature-based detection. Most decompression techniques decompress the executable code in memory. Virtual machine software protection translates an executable's original code into a special format that only a special virtual machine can run. A virtual machine is then called to run this code.
Tactics:	Defense Evasion
Data Sources:	File: File Metadata
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may delete files left behind by the actions of their intrusion activity. Malware, tools, or other non-native files dropped or created on a system by an adversary (ex: Ingress Tool Transfer ) may leave traces to indicate to what was done within a network and how. Removal of these files can occur during an intrusion, or as part of a post-intrusion process to minimize the adversary's footprint.
Tactics:	Defense Evasion
Data Sources:	Command: Command Execution, File: File Deletion
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may interact with the Windows Registry to gather information about the system, configuration, and installed software.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation, Windows Registry: Windows Registry Key Access
Platforms:	Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get a listing of security software, configurations, defensive tools, and sensors that are installed on a system or in a cloud environment. This may include things such as firewall rules and anti-virus. Adversaries may use the information from Security Software Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Firewall: Firewall Enumeration, Firewall: Firewall Metadata, Process: OS API Execution, Process: Process Creation
Platforms:	Azure AD, Google Workspace, IaaS, Linux, macOS, Office 365, SaaS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to get information about running processes on a system. Information obtained could be used to gain an understanding of common software/applications running on systems within the network. Adversaries may use the information from Process Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may attempt to gather information about attached peripheral devices and components connected to a computer system.Peripheral devices could include auxiliary resources that support a variety of functionalities such as keyboards, printers, cameras, smart card readers, or removable storage. The information may be used to enhance their awareness of the system and network environment or may be used for further actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may enumerate files and directories or may search in specific locations of a host or network share for certain information within a file system. Adversaries may use the information from File and Directory Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	An adversary may attempt to get detailed information about the operating system and hardware, including version, patches, hotfixes, service packs, and architecture. Adversaries may use the information from System Information Discovery during automated discovery to shape follow-on behaviors, including whether or not the adversary fully infects the target and/or attempts specific actions.
Tactics:	Discovery
Data Sources:	Command: Command Execution, Process: OS API Execution, Process: Process Creation
Platforms:	IaaS, Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may employ a known encryption algorithm to conceal command and control traffic rather than relying on any inherent protections provided by a communication protocol. Despite the use of a secure algorithm, these implementations may be vulnerable to reverse engineering if secret keys are encoded and/or generated within malware samples/configuration files.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may transfer tools or other files from an external system into a compromised environment. Tools or files may be copied from an external adversary-controlled system to the victim network through the command and control channel or through alternate protocols such as ftp . Once present, adversaries may also transfer/spread tools between victim devices within a compromised environment (i.e. Lateral Tool Transfer ).
Tactics:	Command and Control
Data Sources:	Command: Command Execution, File: File Creation, Network Traffic: Network Connection Creation, Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre

Description:	Adversaries may use an OSI non-application layer protocol for communication between host and C2 server or among infected hosts within a network. The list of possible protocols is extensive.Specific examples include use of network layer protocols, such as the Internet Control Message Protocol (ICMP), transport layer protocols, such as the User Datagram Protocol (UDP), session layer protocols, such as Socket Secure (SOCKS), as well as redirected/tunneled protocols, such as Serial over LAN (SOL).
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Network, Windows
Url:	Open detailed description by Mitre

Behavior Section

Behavior Chronological

Disassembly

Uncategorized

Graph

Loading Joe Sandbox Report ...

Warning!

Windows Analysis Report valyzt.msi

Overview

General Information

Detection

Signatures

Classification

Process Tree

Malware Configuration

Threatname: XRed

Yara Signatures

Initial Sample

Dropped Files

Memory Dumps

Unpacked PEs

Sigma Signatures

System Summary

Suricata Signatures

Joe Sandbox Signatures

AV Detection

Compliance

Spreading

Software Vulnerabilities

Networking

System Summary

Data Obfuscation

Persistence and Installation Behavior

Boot Survival

Hooking and other Techniques for Hiding and Protection

Malware Analysis System Evasion

HIPS / PFW / Operating System Protection Evasion

Language, Device and Operating System Detection

Lowering of HIPS / PFW / Operating System Security Settings

Stealing of Sensitive Information

Remote Access Functionality

Mitre Att&ck Matrix

Behavior Graph

Screenshots

Thumbnails

Antivirus, Machine Learning and Genetic Malware Detection

Initial Sample

Dropped Files

Unpacked PE Files

Domains

URLs

Domains and IPs

Contacted Domains

Contacted URLs

URLs from Memory and Binaries

World Map of Contacted IPs

Public IPs

General Information

Warnings

Simulations

Behavior and APIs

Joe Sandbox View / Context

IPs

Domains

ASNs

JA3 Fingerprints

Dropped Files

Created / dropped Files

C:\Config.Msi\674553.rbs

C:\Program Files (x86)\Microsoft Office\root\vfs\Common AppData\Microsoft\OFFICE\Heartbeat\HeartbeatCache.xml

C:\ProgramData\Microsoft\Windows\WER\ReportQueue\AppCrash_Synaptics.exe_e73781c637c020daee3de6ae263d2d0a91f2a4c_455b7b6e_f18e4e4d-ec94-425b-8f16-23e7406416c5\Report.wer

C:\ProgramData\Microsoft\Windows\WER\Temp\WERB725.tmp.dmp

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA02.tmp.WERInternalMetadata.xml

C:\ProgramData\Microsoft\Windows\WER\Temp\WERCA42.tmp.xml

C:\ProgramData\Synaptics\RCX49C5.tmp

C:\ProgramData\Synaptics\Synaptics.exe

C:\Users\user\AppData\Local\Temp\2MLRDJX.ini

C:\Users\user\AppData\Local\Temp\2zOqNmd.ini

C:\Users\user\AppData\Local\Temp\4wVxH8Y.ini

C:\Users\user\AppData\Local\Temp\88gXYwW.ini

Windows Analysis Report
valyzt.msi

Description:	Adversaries may communicate using OSI application layer protocols to avoid detection/network filtering by blending in with existing traffic. Commands to the remote system, and often the results of those commands, will be embedded within the protocol traffic between the client and server.
Tactics:	Command and Control
Data Sources:	Network Traffic: Network Traffic Content, Network Traffic: Network Traffic Flow
Platforms:	Linux, macOS, Windows
Url:	Open detailed description by Mitre